The vulnerability originates from the nfnetlink_log subsystem of the Linux kernel, where the NFULA_PAYLOAD netlink attribute was constructed manually. The construction omitted zero‑initialization of the trailing padding bytes, which can contain stale heap data. When a packet is sent over the NFLOG netlink socket, those uninitialized bytes are exposed to userspace, allowing a local attacker to read sensitive information from memory. This uninitialized memory usage (CWE‑908) results in information disclosure.

All Linux kernel releases that include the vulnerable nfnetlink_log code before the patch, as the vendor entry lists the Linux operating system itself. The exact kernel versions are not specified, so every affected build should be considered at risk until the fix is applied.

The CVSS score is 5.5, indicating a moderate severity vulnerability. The EPSS score is 0.00035 (< 1%), indicating a very low probability of exploitation, and the issue is not listed in the CISA KEV catalog. The attack vector is inferred to be local: an attacker must access the NFLOG netlink socket, typically requiring CAP_NET_ADMIN or similar privileges, limiting exploitation to privileged users or processes. The vulnerability does not provide remote code execution or denial of service; its impact is limited to leaking stale memory contents.