The Linux kernel’s nx crypto module allocates bounce buffers with a four‑page order but frees them with free_page(), which releases only one page. This mismatch causes a gradual memory leak. The CVE description does not state that the bug allows code execution or privilege escalation; it only describes the resource exhaustion, so it is inferred that the impact is limited to memory exhaustion and performance degradation.

Any Linux installation that includes the nx842_crypto module is potentially affected. The CPE string references the generic Linux kernel, indicating all kernel versions prior to the patch may be vulnerable regardless of distribution. No vendor or version limits are listed, so any deployment using that module is at risk.

The CVSS score of 5.5 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited or no public exploitation. The bug requires executing code in the kernel or triggering the allocation/free logic from privileged context. Thus, the primary risk is potential memory exhaustion leading to service disruption, not immediate compromise of confidentiality or integrity. The likely attack vector is through a use of the nx crypto API by a privileged process or a malicious application that gains kernel privileges.