The Linux kernel function bpf_crypto_ctx_create validates the size of the buffer it receives only after it reads two reserved fields at offsets 14 and 15. Because the size check is performed too late, a malicious caller can supply a smaller buffer that satisfies the verifier but causes the kernel to read beyond the boundary of the provided memory. The resulting out‑of‑bounds read can leak kernel memory or overwrite kernel data. This weakness is an out‑of‑bounds read (CWE‑125). Based on the description, it is inferred that this overread could be exploited to read sensitive kernel data or corrupt critical structures, potentially enabling privilege escalation.

All Linux kernel releases that do not yet contain the patch that moved the size check before the reserved field reads are affected. The advisory does not list exact kernel versions, so any kernel older than the commit that introduced the fix remains vulnerable. Systems that load BPF programs from untrusted sources are particularly at risk.

EPSS data is not available and the vulnerability is not listed in CISA KEV. No public CVSS score has been reported. The likely attack vector is local and requires an actor with CAP_BPF or root privileges to inject a crafted BPF program. Although an active exploit is not reported, the overread could expose kernel memory or serve as a foothold for further exploitation. Given the potential impact, the risk is considered high enough to warrant immediate patching.