The vulnerability arises when the IMA module creates securityfs files for hash algorithms that are not supported by the TPM. The crypto_id is initialized to an out‑of‑range value when the TPM advertises an unsupported algorithm, and subsequent code accesses hash_algo_name[] using this invalid index, resulting in a global out‑of‑bounds read. This can trigger a KASAN fault during boot, causing a kernel crash and a denial of service.

Linux kernel implementations that have not incorporated the IMA securityfs patch. In particular, any kernel version prior to the fix merged into the 6.12 series—including 6.12.40 and earlier—can exhibit the out‑of‑bounds read if an unsupported TPM hash algorithm is present. Systems running unpatched 6.12 kernels or earlier versions will be affected.

The impact is limited to a local kernel crash; it does not provide remote code execution or privilege escalation. No CVSS or EPSS score is publicly published, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires local or privileged access to the TPM interface, making it unlikely unless an attacker can influence the TPM algorithm list. The potential impact on critical systems is high if the kernel is forced to reboot.