The kernel erroneously maps hardware error code -EBUSY to -EIO after exhausting retry attempts. This incorrect error propagation causes the crypto API’s completion wrapper to treat the failure as a queueing status and silence it, preventing the completion callback from firing. Callers relying on crypto_wait_req() therefore wait indefinitely, resulting in a persistent block in processes that request cryptographic operations.

All Linux kernel releases are affected because the vulnerability description lists the Linux kernel as the affected product, but no specific version range is provided. Administrators should assume that older kernels lacking the corresponding commit are vulnerable.

The vulnerability manifests as a denial of service when a hardware accelerator repeatedly returns –EBUSY during key conversion. EPSS score is <1%, and the CVSS score of 5.5 indicates a moderate severity. The issue is not listed in the CISA KEV catalog, but the impact can be significant in environments that rely heavily on cryptographic hardware or perform many key conversions. The attack vector is most likely local or privileged, requiring an entity capable of triggering crypto requests against a kernel using the affected hardware path.