The Linux kernel eip93 HMAC setkey routine misuses the CRYPTO_ALG_ASYNC mask when allocating a temporary hash transform. Because the EIP93 hash algorithms are async, the lookup fails and the cryptographic context is left only partially initialized, leaving a pointer that later becomes null. When the AEAD path processes this context, it dereferences the null pointer and the kernel panics. This fault is a classic null pointer dereference in a privileged kernel module that results in a system-wide denial of service.

All Linux kernel installations that include the eip93 cryptographic driver are impacted. The vendor information lists the kernel itself, and no specific kernel version is mentioned, so any kernel containing the unpatched eip93 code path is vulnerable.

The severity is high because any successful trigger results in an unrestricted kernel crash. The attack may require local privileged code that calls the AEAD setkey routine, but if the cryptographic service is exposed to untrusted input, remote exploitation is conceivable. No CVSS or EPSS score is provided, and the vulnerability is not listed in CISA KEV. The fault is deterministic and does not depend on complex conditions, indicating a high likelihood of exploitation once the vulnerable code is executed.