The Linux kernel tegra crypto driver miscalculates the rctx->cryptlen value when the authentication size is not set by the caller, leading to an out‑of‑bounds write into the destination scatter‑gather buffer. This memory corruption can overwrite kernel data and potentially allow a local attacker to execute arbitrary code or crash the operating system.

All Linux kernel releases that embed the tegra crypto subsystem are susceptible before the patch. The vulnerability is present in kernel builds that provide the tegra_gcm_do_one_req() function, which is typically used on Nvidia Tegra platforms. Any distribution kernel that has not yet incorporated the upstream fix is affected.

No CVSS score is provided, but the nature of the overflow indicates a high severity. EPSS data is unavailable and the vulnerability is not listed in CISA's KEV catalog, suggesting no publicly known exploits yet. The attacker would need local code execution capabilities to trigger a cryptographic request with an unset authentication size, so the vector is local but feasible for privileged or compromised users. Successful exploitation could lead to privilege escalation or denial of service by corrupting kernel memory.