The vulnerability arises from the Linux kernel's PF_KEY path for IPComp when creating a security association: the alg_key_len field of the compression algorithm structure is never initialized. When an IPComp state is later cloned during a migration operation, that uninitialized length is used to calculate the size to copy, causing kmemdup to read beyond the allocated object and trigger a kernel crash. The bug therefore results in a denial‑of‑service by crashing the kernel, with no disclosed data leakage or other confidentiality impact.

All Linux kernel releases that have not incorporated the fix for initializing calg->alg_key_len are affected. The bug is agnostic to specific version numbers, meaning any kernel that exposes PF_KEY traffic for configuring IPComp security associations without the upstream change is vulnerable. Practically every distribution kernel that does not ship an updated version that contains the upstream commit fixing this issue could be impacted.

The CVSS score of 7.1 indicates a high severity; the EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog, which signals a low likelihood of exploitation in the wild. The attack requires a user that can send PF_KEY messages to add an IPComp security association and then trigger the migration path via XFRM netlink. Because PF_KEY typically requires elevated privileges, the vector is typically local privileged or requires a compromised privileged user. Once the migration is triggered, the kernel crashes, providing a straightforward denial‑of‑service path.