The vulnerability arises in the Linux kernel’s ChaCha20-Poly1305 implementation. The chachapoly_create() function accepts a compatibility poly1305 template argument but incorrectly assumes a second template argument is always present. When the argument is omitted, crypto_attr_alg_name() returns an error pointer; the code then passes this pointer to strcmp() without checking, resulting in a null pointer dereference that can trigger a kernel panic and a denial of service. The flaw does not provide an attacker with code execution or escalated privileges, but it can crash the kernel if a malformed template is instantiated, either locally or through a module that invokes the cryptographic API.

The issue affects all Linux kernel images that do not include the patch applied in commit e74df53b … The vulnerability applies to any build of the Linux kernel that predates the commit resolving the issue. No specific vendor version list is provided; the affected product is the Linux kernel itself. Anyone running a kernel that has not incorporated this commit is potentially vulnerable.

The EPSS score is reported as less than 1 %, indicating a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Exploitation would likely require local or privileged access to trigger the vulnerable code path, such as loading a malicious module or invoking the crypto API from a user-space program that can provide a malformed template. The absence of a CVSS score prevents a precise severity assessment, but the combination of a low EPSS, lack of public exploitation, and the need for privileged access suggests the overall risk is low to moderate. The flaw results in denial of service rather than code execution, which further limits its potential impact.