The vulnerability involves Zen1 CPUs, where the hardware divider can leave partial results from previous operations in its state register. Under certain circumstances an attacker thread can read these partial results, leaking sensitive information from other threads. The weakness is an instance of information exposure through partial data (CWE-212). Additionally, NVD lists no further CWE information (marked NVD-CWE-noinfo). The primary impact is the disclosure of memory contents to a local attacker running a competing thread.

All Linux kernel versions before the commit that introduced the fix for Zen1 CPUs are affected. The affected products are Linux kernels running on systems with Zen1 CPUs. Specific kernel versions are not enumerated in the advisory; any version prior to the patch is considered vulnerable.

The CVSS score of 5.5 indicates a moderate risk. The EPSS score is below 1%, showing a very low exploitation probability in the current threat landscape. The vulnerability is not listed in the CISA KEV catalog. Because the flaw depends on leaking data from a CPU divider, the attack vector is local and requires an attacker thread running on the same system with access to the CPU. No remote or privilege escalation mechanisms are described.