The Linux kernel function bpf_crypto_ctx_create validates the size of its input buffer only after reading two reserved fields at offsets 14 and 15. Because the size check runs too late, a caller can supply a buffer that meets the verifier’s size expectation yet is smaller than the full structure, causing the kernel to read past the supplied memory region. This out‑of‑bounds read (CWE‑125) could expose kernel memory contents that were not intended to be revealed. The description does not indicate that any kernel data is overwritten, only that an overread may be possible.

All Linux kernel releases that do not include the commit that moves the size check before the reserved field reads are vulnerable. The advisory does not list exact kernel versions, so any kernel older than the fix remains affected. Systems that load BPF programs from untrusted sources are particularly at risk. Purchase or derive the exact kernel version from the commit list to determine applicability.

The EPSS score is less than 1% and the vulnerability is not listed in CISA’s KEV catalog, while the CVSS score is 4.4. Based on the description, the likely attack vector is local: an attacker who can load a BPF program with CAP_BPF or root privileges can supply the crafted buffer to trigger the overread. The vulnerability does not appear to be publicly exploited, but the potential to read arbitrary kernel memory provides a foothold for further privilege escalation steps in a more complex attack chain.