The vulnerability is an out-of-bounds read in the Linux kernel keyring subsystem, specifically in the function keyring_get_key_chunk(). When the read pointer is advanced past the inline prefix, the implementation only checks that prefix and neglects to verify the bounds of the full key description. By supplying two same‑type keys that collide in hash, type and domain_tag through an unprivileged add_key(2) call, the kernel will read beyond the memory allocated by kmemdup(desc, desc_len + 1). This results in a slab out-of-bounds read that can expose arbitrary kernel memory.

All Linux kernel installations that have not incorporated the fix are vulnerable. The issue is not limited to a particular kernel version in the CVE data, so any system running a Linux kernel prior to the commit referenced in the provided patch links is at risk. Vendors identified include Linux:Linux, representing all general purpose Linux kernels.

The CVSS score of 7.1 signifies a high impact vulnerability, while the EPSS score of less than 1% indicates a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires local, unprivileged access and the ability to craft colliding key pairs via add_key(2). The described exploit results in a slab out-of-bounds read, but further impact is not specified in the CVE.