The vulnerability arises when the Linux kernel’s crypto subsystem allows an authenticated encryption instance to be created with an invalid authentication size derived from an ahash digest size of 1 to 3 bytes. Because the instance inherits this unsupported default authsize, subsequent cryptographic operations can trigger an out‑of‑bounds access when the kernel processes the short authentication tag. An attacker who can trigger the flawed path—by crafting or manipulating data passed to AF_ALG or a similar cryptographic interface—could cause a kernel memory corruption that may lead to execution of arbitrary code or a kernel panic, thereby compromising system integrity and availability.

All Linux kernel distributions that implement the crypto/authencesn module, as no specific kernel version was provided. The issue is present wherever the default authentication size is inherited during instance creation without proper validation.

The CVSS score of 7.0 indicates high severity, and the EPSS score is not listed, so the quantitative mean time between attacks remains unknown. The vulnerability is not listed in the CISA KEV catalog. However, the flaw allows memory corruption in kernel space, which is a high‑risk condition for an attacker with the ability to provide malicious input to AF_ALG or a related interface. The lack of a proactive validation step makes the attack surface significant, and the kernel’s privileged execution context could enable privilege escalation or full system compromise if successfully exploited.