The vulnerability arises in the Linux kernel’s ECC implementation, where an incorrect carry handling in the vli multiplication routine can cause the multiplication result to be wrong when the high 64‑bit part saturates and the lower part overflows. This is a CWE‑190 integer overflow weakness that may lead to malformed ECC keys or signatures, weakening the integrity and confidentiality guarantees of systems that rely on these cryptographic primitives.

All Linux kernel versions that include the crypto/ecc.c code before the patch that introduces proper carry handling are potentially affected. The vendor is Linux and the product is the Linux kernel, as identified by the cpe string. No specific version list is supplied in the advisory, so any kernel that uses the unpatched ECC routine is at risk.

The CVSS score of 8.8 indicates a high severity impact. The EPSS score of less than 1% suggests a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Exploitation would require privileged or kernel‑level access, and is likely to be limited to local attackers or attackers who can influence kernel space or an ECC‑dependent application. The likely attack vector is inferred to be a local privilege escalation or compromise of an ECC‑dependent application; no public exploit is documented.