The vulnerability resides in the Linux kernel’s cryptographic pcrypt subsystem. When a child AEAD request is submitted through the parallel data path, the code installs a callback, pcrypt_aead_done, before attempting the submission. If the parallel path is unavailable and the routine returns -EBUSY, the code falls back to executing the child AEAD directly. However, it incorrectly retains the original asynchronous callback, causing the callback routine to be invoked on a request that was never queued. This can lead to unintended behavior, as the callback routine may be triggered for a request that has not been scheduled. The weakness reflects a failure to restore callback state during fallback.

All deployments of the Linux kernel that have not incorporated the patch restoring the original callback are affected. The flaw exists in the core cryptographic module and is present in every release without the fix, regardless of hardware or additional configuration.

EPSS indicates a very low probability of exploitation in production environments, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 7.5 denotes high severity, and the attack requires exploitation of the vulnerable crypto path in the kernel; the CVE description does not specify privilege requirements. Overall risk remains low to moderate, but patching is advisable to mitigate any adverse effects.