The flaw occurs when keyctl_describe_key formats a key's description. During the first formatting pass the name of the key type is copied into the argument buffer without holding the key's semaphore. If, while the formatter waits for a second pass, the module providing that key type unloads, the key type’s name can be freed. The formatter then continues with the second pass and reads the now‑invalid name, triggering a page fault and crashing the kernel. This use‑after‑free can cause a denial of service.

All Linux kernels that include the keys subsystem and can load the AF_RXRPC module are potentially affected. The vendor is Linux, product Linux Kernel. No specific kernel version range is listed, so any installation prior to the patch commit that introduced the fix is vulnerable. Users running kernels that still reference the vulnerable keyctl_describe_key implementation are at risk.

The CVSS score of 7 indicates high severity, and the EPSS score is not available, suggesting that no widespread exploitation has been observed yet. The vulnerability is not listed in the CISA KEV catalog. Because the fault occurs in kernel context and involves module unloading, remote exploitation is unlikely; however, any local privileged user or administrator can trigger the fault by combining a keyctl DESCRIBE call with unloading a module that registers a key type.