The Linux kernel tegra crypto driver miscalculates the rctx->cryptlen value when the authentication size is not set by the caller, leading to an out‑of‑bounds write into the destination scatter‑gather buffer. This memory corruption can overwrite critical kernel data and may allow a local attacker to execute arbitrary code or crash the operating system.

All Linux kernel releases that include the tegra crypto subsystem are vulnerable prior to the upstream fix. The flaw exists in any kernel build that exposes the tegra_gcm_do_one_req() function.

The CVSS score of 7.8 classifies the vulnerability as high severity. The EPSS score of less than 1% and the fact that it is not listed in the CISA KEV catalog suggest that publicly known exploits are unlikely so far. Exploitation requires a local user to trigger a cryptographic request with an unset authentication size, which is feasible for privileged or compromised users. Successful exploitation could lead to privilege escalation or a denial‑of‑service by corrupting kernel memory.