In the Linux kernel, the QAT crypto driver incorrectly processes RSA CRT components that exceed half the modulus length. The driver allocates DMA buffers of size key_sz/2 and copies each component right‑aligned. When a component is larger than half_key_sz, the subtraction underflows and a memcpy writes beyond the buffer, corrupting kernel memory. This memory corruption can lead to arbitrary code execution or a kernel crash, as the affected area lies in the privileged address space.

The flaw affects any Linux kernel build that includes the QAT crypto subsystem. No specific kernel version list is provided; the remediation is contained in a commit that updates the qat_rsa_setkey_crt function and is available in recent kernel releases.

The EPSS score is below 1% and the vulnerability is not listed in CISA KEV, but it resides in a privileged kernel module. The likely attack vector involves a local user or process that can trigger QAT RSA operations with a crafted key. Because the driver must be loaded and a malformed RSA key used, the attack surface is limited, yet the severity is high due to the potential for kernel memory corruption and privilege escalation.