The Linux kernel function that creates IPComp (SADB_X_SATYPE_IPCOMP) security associations fails to initialize the calg->alg_key_len field. This uninitialized field is later used as a length when IPComp states are cloned, causing kmemdup to read beyond the allocated structure and trigger a kernel panic. The description states the bug results in a kernel crash; no data disclosure or leakage is documented in the provided information. Thus the primary risk is a denial of service via kernel crash.

All Linux kernel releases that lack the fix for initializing calg->alg_key_len. Any system that supports PF_KEY message traffic for IPComp and allows users to create security associations is potentially affected. No specific version range is indicated, so the issue could exist in any kernel that has not applied the upstream change.

Based on the description, it is inferred that a privileged or PF_KEY-capable user can add an IPComp security association via PF_KEY and then trigger a migration through the XFRM netlink interface. Once migration occurs, the kernel will crash. The EPSS score of less than 1% indicates a low observed exploitation rate, and the vulnerability is not listed in the CISA KEV catalog. The attack path is straightforward and does not require complex conditions, resulting in a high risk for systems that expose PF_KEY and run an unpatched kernel.