This vulnerability occurs in the virtio crypto subsystem of the Linux kernel. The callback that processes device responses uses the backend‑reported length without limiting it to the size of the allocated destination buffer. When the reported length exceeds the allocated buffer, the kernel reads beyond the buffer boundaries, leaking adjacent kernel memory. Such an out‑of‑bounds read can reveal sensitive kernel data and may aid attackers in further escalation or data exfiltration. The weakness is a classic buffer overread flaw (CWE‑125) that can expose confidential information (CWE‑200).

Linux kernel users that load virtio crypto devices are affected. Specific kernel versions are not listed in the advisory, but the fix has been merged into the kernel source and should be present in recent stable releases. All users running a kernel that does not contain the patch are potentially vulnerable.

The advisory does not provide a CVSS or EPSS score, indicating that the exploitation likelihood has not been formally quantified. The known exploitation path requires the ability to influence the virtio crypto device (e.g., through a malicious hypervisor or compromised device driver). While this is a higher‑privilege scenario, it is realistic in virtualized or shared environments. The vulnerability is listed in the background as resolved, but unpatched systems remain at risk of leaking arbitrary kernel memory. No KEV listing suggests that coordinated exploitation has not been observed, yet the potential impact remains significant.