The Linux kernel’s pcrypt module installs a callback for a child AEAD request before submitting it through the parallel data path. When that path is unavailable and the code falls back to invoking the child AEAD directly, it incorrectly leaves the original padata completion callback in place. This residual callback can trigger an asynchronous completion for a request that was never queued in the parallel path, corrupting kernel state. The resulting undefined behavior may lead to a kernel crash, presenting a denial‑of‑service condition. This vulnerability is a manifestation of improper restoration of internal callback state, consistent with the CWE identifiers listed in the report (CWE‑662).

All users of the Linux kernel that include the legacy pcrypt AEAD module without the recent patch are affected. This includes kernel releases prior to the commit that restores the original completion callback, such as the one referenced by commit 3920c5f6edc341729d20d0507e466c6d3b11f372. Systems running default distributions, custom builds, or older kernels should verify that they have applied the fix in their kernel version.

The high CVSS score of 7.5 reflects the severe impact of a kernel crash that could be triggered by the faulty AEAD callback handling. Although the EPSS score is below 1% and the vulnerability does not appear in the CISA KEV catalog, suggesting a low exploitation probability, the description does not state an explicit attack vector. It is inferred that an attacker would need to invoke the vulnerable cryptographic AEAD API from user space in order to trigger the fallback logic, but this inference is not confirmed by the official text and may be subject to further investigation. The practical risk remains moderate because the flaw is confined to the kernel, resulting in a denial‑of‑service that can be mitigated by rebooting or patching the affected kernel.