The vulnerability exists in the Linux kernel's XFRM subsystem. When the function attach_auth_trunc() allocates the algorithm data structure (x->aalg) but leaves the corresponding algorithm selector zero, the subsequent xfrm_state_construct() call mistakenly interprets this as no authentication algorithm being present. It then calls attach_auth(), overwriting the earlier allocation. This leads to a resource leak, as the original allocation is never freed. If abused, repeated allocation and leakage could exhaust kernel memory or expose partial authentication data.

All Linux kernel variants are potentially affected, as the issue is present in the core kernel code. No specific versions are listed in the alert; therefore any system running a Linux kernel before the patch should be considered at risk. The vulnerability applies to the generic Linux kernel distribution.

The vulnerability could be triggered by maliciously crafted network traffic that engages the XFRM subsystem, such as IPsec packets using unsupported authentication algorithms. It is inferred that an attacker with the ability to send such traffic could repeatedly provoke the memory leak, leading to kernel memory exhaustion or denial of service. The CVSS score is not provided, but the absence of an EPSS score or KEV listing suggests that widespread exploitation is not currently documented. Nonetheless, the potential impact on availability warrants monitoring and patching.