The Linux kernel keyring subsystem in its current form processes description bytes in a different order when retrieving a key chunk versus when comparing key objects. This mismatch in byte and bit ordering allows an attacker to engineer key descriptions that appear identical to the keyring comparison function but actually differ in storage. As a result, crafted keys can collide with existing ones, giving the attacker the ability to read or replace keys that they should not have access to, potentially leading to unauthorized privilege use.

All Linux kernel versions distributed before the application of the patch that aligns keyring key‑chunk ordering are affected. This includes every Linux distribution that ships the vulnerable kernel, regardless of vendor, since the issue resides in the core kernel code.

The flaw has a CVSS score of 5.5, reflecting a moderate impact when successfully abused. The EPSS score is less than 1 %, indicating a very low probability of exploitation at the time of assessment, and it is not listed in CISA's KEV catalog. The most likely attack vector is local, requiring an attacker to invoke keyring APIs from within a user or process that has write access to keyrings. If an attacker can create keys with crafted descriptions, the collision may allow unauthorized access to confidential business or system data controlled by those keys.