The Linux kernel’s MCTP implementation has an uninitialized memory read in the function mctp_dump_addrinfo when the ifaddrmsg structure is missing. This causes the code to compare an uninitialized ifa_index field, exposing kernel memory contents and potentially leading to a crash if the data is accessed. The weakness corresponds to CWE‑908, a use of an uninitialized variable. The reported CVSS score of 5.5 reflects a moderate severity, with no indication that the flaw would directly yield remote code execution or privilege escalation.

The bug affects all Linux kernel releases that contain the described code path prior to the fix, including pre‑6.15 releases and the 6.15 release candidates 1 through 6, as listed in the CPE strings. Users running kernels older than 6.15 rc6 should verify whether they are affected.

The EPSS score is below 1 %, indicating a very low probability of exploitation in current attack contexts. The flaw is not listed in CISA’s KEV catalog. An attacker would need local access to the system or influence over user‑space utilities that invoke mctp_dump_addrinfo, such as dhcpd or busybox ip command; hence the attack vector is inferred to be local. Because the vulnerability stems from an uninitialized index field, its exploitation could result in information leakage or denial of service rather than full compromise.