The Linux kernel pcrypt module registers a completion callback on a child AEAD request before submitting it via the parallel data path. When the parallel path is unavailable and the code falls back to executing the child AEAD directly, the original request callback and its data are not restored, leaving a stray asynchronous completion that can be invoked on a request that was never enrolled in the data path. This misuse of the callback can corrupt kernel state and potentially trigger a kernel crash, resulting in a denial of service. The vulnerability is fundamentally an improper restoration of internal kernel state during a fallback path.

All Linux kernel installations that incorporate the legacy pcrypt module without the fix are affected. This includes every kernel release prior to the commit that restores the original callback (for example, the kernel version containing commit 3920c5f6edc341729d20d0507e466c6d3b11f372). Users of mainstream distributions as well as custom or legacy kernels should verify that their system runs a kernel version that includes the patch.

The CVSS score of 7.5 marks this flaw as high severity, but the EPSS score is less than 1% and the vulnerability is not listed in the CISA KEV catalog, indicating a low likelihood of widespread exploitation. The attack vector is most likely local, as an attacker must invoke the cryptographic API from user space to trigger the faulty fallback logic. Successful exploitation would lead to a kernel crash or unexpected reboot, thereby denying service to all applications.