A local race condition in the Linux kernel cryptographic interface could allow an unprivileged user to recover sensitive plaintext data from concurrent cryptographic operations.

This is a race condition in the algif_skcipher interface where concurrent operations can manipulate initialization vectors (IVs) during asynchronous encryption. This forces the operation to execute under an attacker-controlled IV, which permits an authenticated local user to bypass cryptographic protections.

With a CVSS score of 7.1, this vulnerability poses a high risk to data confidentiality. By recovering plaintext from stream ciphers, an attacker can gain access to sensitive information processed by the kernel, such as encrypted communications or stored secrets. This breach of confidentiality can lead to unauthorized data access and significant security policy violations.

Immediate Action: Update the Linux Kernel to version 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.104, 6.18.45, 7.1.9, or mainline 7.2.

Proactive Monitoring: Review system audit logs for unusual process behavior or repeated failures related to cryptographic socket operations.

Compensating Controls: Restrict access to the system to only trusted users to prevent unprivileged local execution of malicious code.

Public Exploit Available: No (there is no confirmed public exploit in the available data).

System administrators must prioritize kernel updates to the specified fixed versions. Because this vulnerability targets the fundamental security of cryptographic operations within the kernel, delaying patching significantly increases the risk of sensitive data exposure.