Risk assessment is an inevitable step in implementation of a cyber-defense strategy. An important part of this assessment is to reason about the impact of possible attacks. In this paper, we study the problem of estimating the impact of cyber-attacks in stochastic linear networked control systems. For the stealthiness constraint, we adopt the Kullback-Leibler divergence between attacked and nonattacked residual sequences. Two impact metrics are considered: the probability that some of the critical states leave a safety region and the expected value of the infinity norm of the critical states. For the first metric, we prove that the optimal value of the impact estimation problem can be calculated by solving a set of convex problems. For the second, we derive efficiency to calculate lower and upper bounds. Finally, we show compatibility of our framework with a number of attack strategies proposed in the literature and demonstrate how it can be used for risk assessment in an example.