A defect in the Linux kernel’s qce cryptographic driver causes the error handling logic to repeatedly call the same unregister function when algorithm registration fails. The bug results in an incorrect cleanup loop that may leave resources improperly released, potentially leading to kernel instability such as a crash that denies service to users.

All Linux kernel releases that ship the qce cryptographic module and have not yet incorporated the commit correcting the error path are affected. This includes the core Linux kernel provided by all major distributions and any custom kernel builds that include the qce driver.

The CVSS score of 7.8 reflects high severity, but the EPSS score is very low at below 1%, and the vulnerability is not listed in CISA KEV. No public exploits are documented. Exploitation requires local or privileged kernel execution to trigger the erroneous registration routine; an attacker would need to induce a registration failure or otherwise cause the faulty loop to execute. In environments where the kernel remains unpatched and the qce module is active, the risk is moderate to high due to the potential for a kernel crash that would shut down services and deny availability.