The bug in the atmel-tdes driver causes the kernel to synchronize DMA output using the direction intended for a device, rather than synchronizing it for the CPU. On platforms where memory is not coherently shared between the CPU and devices, this misuse makes the CPU read stale cache entries after a DMA write. The consequence is that the processor may observe outdated or incorrect data, potentially exposing sensitive information or causing corrupted cryptographic results. This is not a remote code execution flaw but can lead to data corruption or inadvertent data disclosure.

All Linux kernel builds that include the atmel-tdes crypto driver and run on non‑coherent memory platforms are affected. The CVE identifies the kernel as the product but does not list specific version ranges; therefore the vulnerability applies to all kernel releases prior to the release of the fix. The vendor for the affected product is Linux, product name Linux kernel.

The severity of the issue is not quantified by a CVSS score, and no EPSS data is available, but the bug can be leveraged by an attacker who can induce the kernel to perform a DMA write via the vulnerable driver. Compromise is limited to platforms that use non‑coherent DMA, which narrows the attack surface. Attackers could extract stale data from the cache or observe corrupted cryptographic output, potentially facilitating further attacks. The bug is not listed in the CISA KEV catalog, suggesting no sign of widespread exploitation at this time.