The vulnerability occurs in the Linux kernel’s ChaCha20-Poly1305 crypto implementation. The function chachapoly_create() accepts an optional second template argument, but if that argument is missing it still passes the resulting error pointer returned by crypto_attr_alg_name() into strcmp() without validation. This causes a null pointer dereference that can crash the kernel, resulting in a denial‑of‑service condition. The issue mirrors the usual Crypto API template pattern, where crypto_attr_alg_name() results should be validated before string usage.

All Linux kernel images that have not been updated with the Poly1305 template argument validation fix. The fix applies to every distribution’s kernel before the patch; the vulnerability is not limited to a specific kernel version. Systems running the unsupported kernel code are affected.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalogue. If a malformed Poly1305 template is processed by the kernel, the unvalidated error pointer can lead to a kernel crash and a denial‑of‑service impact. No specific information about required privileges or access is provided in the CVE data, so the risk depends on the ability of an attacker to cause the kernel to process such a template argument.