In the Linux kernel block layer, the auto‑generated integrity buffer for writes was not fully initialized when the metadata size exceeded the PI tuple. This leaves a segment of the buffer in an uninitialized state that can be read back by userspace or anyone with physical access to the storage device, allowing the disclosure of previously written data. The flaw is a classic uninitialized memory leakage (CWE‑908) and poses a confidentiality risk.

The vulnerability impacts the Linux kernel, specifically the 6.11 series and the 6.19 series release candidates up to rc8, as identified in the CPE catalog. Any system running one of these kernel versions without the patch is susceptible, regardless of distribution. The defect resides in the core block layer code, so all distributions using the affected source code are affected until the fix is applied.

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of less than 1% reflects a low probability of exploitation. The flaw is not listed in the CISA KEV catalog, suggesting limited known exploitation. An attacker would need local or physical access to the machine or the block device to read uninitialized metadata; the vulnerability is confined to integrity buffer handling and cannot be leveraged remotely without additional local privileges.