An incorrect error handling path in the Linux kernel’s qce crypto driver causes the same unregister operation to be invoked repeatedly when an algorithm registration fails. The loop uses the same index for all attempts instead of the actual index of previously registered algorithms, which can leave the kernel in an inconsistent state. This flaw prevents proper cleanup of resources and may lead to memory corruption, kernel panic, or denial of service if the subsystem is repeatedly attempted to be initialized.

The flaw is present in the generic Linux kernel across all distributions that rely on the qce crypto module by default. There are no vendor‑specific product variations listed; the issue applies universally to any kernel version that includes the qce driver before the fix was committed.

Because the vulnerability requires an operation that derails the kernel’s cryptographic module registration, it is a local‑kernel problem that would typically be exercised by privileged code such as a kernel module or system service. No publicly available KEV entry or EPSS score is reported, and the CVSS metrics are not disclosed. The impact is primarily a potential denial of service or data corruption within the affected host. The description suggests the flaw may be triggered during normal system startup on a vulnerable kernel, but the lack of a publicly exploitable path reduces the likelihood of widespread exploitation at this time.