The vulnerability (CVE-2025-68726) in the Linux kernel's crypto AEAD implementation stems from improper initialization of the reqsize field after the introduction of the cra_reqsize field in the crypto_alg struct. The change intended to unify reqsize handling across cryptographic algorithms but did not update the AEAD framework functions to set reqsize correctly from cra_reqsize. This mismatch causes memory corruption and kernel crashes. The issue was fixed by adding proper set_reqsize calls in the AEAD initialization function to correctly initialize reqsize for these algorithms.

Exploitation of this vulnerability can cause memory corruption leading to kernel crashes (denial of service) and potentially allow attackers to compromise system confidentiality and integrity due to improper cryptographic operations. The CVSS vector indicates network attack vector, low attack complexity, no privileges or user interaction required, with high impact on confidentiality, integrity, and availability.

A fix has been implemented in the Linux kernel by properly initializing the reqsize field in AEAD algorithms during their initialization. Users and administrators should apply the official Linux kernel updates that include this fix. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor or Linux kernel mailing lists for the latest patches and updates addressing CVE-2025-68726.