In the Linux kernel's key management subsystem, the function keyctl_pkey_params_get_2 calculates the size of an internal output buffer incorrectly. When a caller supplies a buffer smaller than the maximum size required for a cryptographic primitive, the kernel writes past the end of that buffer, corrupting memory. This out‑of‑bounds write is a CWE‑787 buffer overrun and can lead to kernel memory corruption. If an attacker can trigger the overflow, they could potentially gain local root privileges or cause system instability.

The flaw resides in the core Linux kernel code, affecting all distributions running the vulnerable kernel version. Because no specific releases are listed, any unpatched kernel may be vulnerable. The vendor list identifies Linux:Linux, indicating widespread impact across all Linux systems that have not applied the patch.

The CVSS score of 7.8 classifies this as a high‑severity vulnerability. The EPSS score of less than 1% indicates that exploitation is unlikely to be common in the near term. The vulnerability is not listed in the CISA KEV catalog. In terms of attack vector, the likely scenario involves a local attacker invoking the keyctl system call with an undersized buffer; based on the description, it is inferred that the attacker would need local access to the system to exploit the flaw. Successful exploitation could result in kernel memory corruption, privilege escalation, or a denial of service.