The bug was a failure to correctly handle EBUSY responses from MAY_BACKLOG requests in the Linux kernel’s crypto: pcrypt interface, causing EINPROGRESS notifications to be filtered incorrectly and leaving cryptographic operations hanging or retrying endlessly, which can degrade performance or exhaust resources, effectively a denial of service.

All Linux kernel releases that contain the unpatched pcrypt code are affected; the advisory does not list specific versions, so any kernel build before the patch that includes the old code is potentially vulnerable. Administrators should verify whether their kernel incorporates the fix referenced in the advisory.

The CVSS score of 9.8 and EPSS score of < 1 % indicate a high severity but low current exploitation probability, and the vulnerability is not in the CISA KEV catalog. A local attacker with kernel access could exploit the error handling flaw to disrupt cryptographic services or, in combination with other kernel bugs, could potentially aid in privilege escalation. The impact is local and depends on the use of the pcrypt interface on the system.