The vulnerability is a stack memory leak in the RDMA/ionic driver, specifically in the ionic_create_cq() routine. Uninitialised fields leave 7 to 11 bytes of kernel stack data exposed, which could contain sensitive kernel state. The flaw is classified as an information‑exposure issue (CWE‑908).

All Linux kernels that include the RDMA/ionic driver are affected. No specific versions are listed, so any distribution that has not installed the recent patch containing the driver fix remains vulnerable. Administrators should verify whether their running kernel contains the commit that resolves the leak.

EPSS shows a probability of exploitation of less than 1 %, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is local or privileged; an attacker with the ability to interact with the RDMA driver can trigger ionic_create_cq() and read the leaked bytes. While no public exploit has been disclosed, leaking even a few bytes can provide footholds for further privilege escalation or credential theft, depending on the context in which the kernel is used. The risk remains moderate, with low exercise probability but potential impact if the leaked information is valuable.