ecryptfs_parse_tag_70_packet subtracts fixed metadata fields from the packet body size to derive the encrypted filename size. A malformed packet whose body is smaller than those fixed fields causes an unsigned integer underflow, potentially leading the kernel to read or write memory outside the intended bounds. The resulting kernel fault would crash the system, causing a denial of service. This weakness is an instance of integer underflow (CWE-191).

The flaw resides in. All Linux distributions that ship an unpatched kernel and enable ecryptfs—whether through user mounts or kernel modules—could be affected. No specific kernel release is listed in the CNA data, so any kernel version that has not yet incorporated the fix may be vulnerable.

The CVSS score of 4.7 indicates moderate severity. The EPSS score of 0.00175 indicates an extremely low exploitation probability, and the vulnerability is not listed in CISA KEV, suggesting limited current exploitation activity. The likely attack vector is remote or local delivery of a crafted ecryptfs packet to a system that accepts ecryptfs data, as inferred from the kernel’s parsing routine. An attacker who can supply such a packet could trigger a crash and disrupt service, although this does not lead to code execution or data disclosure.