Linux Kernel EUVD-2026-25644

Exploitation requires a local account with the ability to create and interact with AF_ALG sockets - corresponding to CVSS PR:L. The vulnerable code path is triggered specifically when issuing recvmsg on an AF_ALG socket configured for skcipher (symmetric cipher) operations under a condition where the receive buffer is partially consumed and insufficient space remains for a full scatter-gather chunk. On default Linux configurations with unprivileged user namespaces disabled, AF_ALG socket access may be restricted to privileged processes, raising the effective barrier beyond PR:L in those environments; on systems with permissive namespace policies or container runtimes that expose AF_ALG (e.g., certain Kubernetes worker nodes), unprivileged exploitation is more accessible. Remote exploitation is categorically not possible (AV:L). There is no confidentiality or integrity impact - exploitation is limited to availability (kernel DoS).

The CVSS 3.1 score of 5.5 (Medium) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H accurately reflects the local, low-privilege nature of exploitation with high availability impact. There is no confidentiality or integrity impact. EPSS at 0.02% (5th percentile) is consistent with the narrow attack surface - a local user must be able to open and interact with AF_ALG skcipher sockets, which is not universally available to unprivileged users. The vulnerability is not in CISA KEV and no POC has been identified, further supporting a low near-term risk posture for most environments. One notable inconsistency: the source data tags this CVE as 'Information Disclosure,' which directly conflicts with the CVSS C:N rating; this discrepancy is unresolved and may reflect a metadata error or an undocumented secondary effect - verify with the vendor before deprioritizing on confidentiality grounds. Real-world impact is highest in multi-tenant environments or container platforms where unprivileged users have AF_ALG socket access without namespace restrictions. Compared to the raw CVSS, real-world priority is low for most enterprise deployments.

A local, low-privileged user on a multi-tenant Linux host or container platform opens an AF_ALG socket configured for skcipher operations and issues a crafted recvmsg call sequence designed to partially consume the receive buffer. When the remaining budget is insufficient for the next chunk but additional data is pending, the improper accounting causes the kernel to process a zero-length crypto request, triggering a kernel fault or hang that denies service to all users on the system. No public POC is known at time of analysis.