The vulnerability arises when the Linux kernel does not clear the struct iw_point on 64‑bit architectures, allowing a user‑space process to read 32 bits of kernel data via wifi ioctl calls. The primary impact is the disclosure of kernel memory contents, which could aid an attacker in building an exploit. The attack vector is inferred from the description: a crafted struct iw_point sent through a wifi ioctl can trigger the leak without requiring elevated privileges.

All Linux kernel builds that contain the unpatched struct iw_point implementation are affected. The CPE list includes every Linux kernel and specifically the 6.19 release candidates 6.19rc1 through rc4. Stable kernels derived from the same source tree before the patch were also affected; therefore, any current 64‑bit kernel version lacking the zeroing fix is potentially vulnerable.

The CVSS score of 3.3 classifies this as low severity. The EPSS score indicates an exploitation likelihood of less than 1%, and the vulnerability is not listed in the CISA KEV catalog. An attacker can trigger the leak from any user‑space process able to issue wifi ioctl commands; no privilege escalation is required, but the disclosed information could be useful for subsequent attacks.