The Linux kernel eip93 HMAC setkey routine misuses the CRYPTO_ALG_ASYNC mask when allocating a temporary hash transform. Because the EIP93 hash algorithms are async, the lookup fails and the cryptographic context is left only partially initialized, leaving a pointer that later becomes null. When the AEAD path processes this context, it dereferences the null pointer and the kernel panics. This fault is a classic null pointer dereference in a privileged kernel module that results in a system‑wide denial of service.

All Linux kernel installations that include the eip93 cryptographic driver are impacted. The vendor information lists the kernel itself, and no specific kernel version is mentioned, so any kernel containing the unpatched eip93 code path is vulnerable.

The CVSS score of 5.5 indicates a medium severity vulnerability. The EPSS score of < 1% shows a low exploitation probability, and the vulnerability is not listed in CISA KEV. Based on the description, it is inferred that remote exploitation could be possible if the cryptographic service is exposed to untrusted input. An attacker requires local privileged code that calls the AEAD setkey routine; however, if the cryptographic service is exposed to untrusted input, remote exploitation is conceivable. The fault is deterministic and does not depend on complex conditions, suggesting that the vulnerability is exploit‑able whenever the unpatched code path is executed.