The vulnerability in the Linux kernel's rk3288 crypto driver causes ahash requests to incorrectly finalize when the hardware hash engine fails to become idle within an expected timeout. The driver ignores the timeout poll result, reads stale digest registers, and reports a previous successful hash value. This flaw can lead to an unauthorized user receiving a valid hash for data that was not actually processed, potentially undermining cryptographic integrity checks or authentication mechanisms that depend on accurate hash results. The weakness aligns with CWE-676 and CWE-368, reflecting incorrect error handling and misuse of stale data.

The affected product is the Linux kernel, as identified by the Linux:Linux CNA vendor entry. All kernel versions before the fix described in the linked commits are vulnerable; specific version ranges are not specified. Kernel CPE strings indicate the flaw exists across the broader Linux kernel ecosystem.

The EPSS score is less than 1%, suggesting very low probability of exploitation in the wild, and the vulnerability has not been listed in the CISA KEV catalog. Without a CVSS score, the severity is unclear, but the flaw permits misuse of cryptographic results, which could have non‑repudiation or integrity impacts in systems that rely on the rk3288 crypto engine. The likely attack vector is a local privilege escalation or a user with the ability to invoke cryptographic hash operations on the affected device, inferred from the nature of driver operations. No publicly documented exploitation exploits are indicated, and the risk appears limited to environments that use the rk3288 crypto hardware without additional safety checks.