The vulnerability arises from a mismatch in pointer types used in the Linux kernel crypto subsystem. A call to nx_crypto_ctx_exit receives a crypto_shash_ctx object instead of the expected crypto_tfm, causing the kernel to dereference an invalid memory address, which triggers a kernel oops and an access violation. This results in a kernel crash that manifests as an uncaught SIGSEGV (signal 11) and requires a reboot or causes loss of service. Attackers who can invoke the affected cipher functions, such as through the AF_ALG interface or by running utilities like hardlink(1), can therefore bring the system down by forcing the shutdown sequence to fail.

Linux kernel, all releases prior to the applied fix – any system running an unpatched kernel is potentially affected.

The CVSS score of 7.8 indicates a high impact, while the EPSS score of less than 1 % reflects a very low likelihood of exploitation in the wild. The flaw is not listed in CISA’s KEV catalog. Exploitation requires local or semi‑local access to the cryptographic AF_ALG interface; an attacker would need to trigger the shutdown sequence of a crypto module, typically via a user‑owned socket or by executing a utility that exercises AF_ALG. Because the symptoms produce a complete kernel panic, even a single successful execution of the vulnerable code will result in a denial of service.