The flaw resides in the xfrm kernel module’s build_polexpire() function, which fails to clear the padding bytes that follow the hard field in a struct xfrm_user_polexpire. Because these bytes are left uninitialized, they are copied from kernel heap memory and then sent to userspace via netlink multicast when a XFRMNLGRP_EXPIRE listener receives the message. The result is an information disclosure of arbitrary kernel heap contents to any process that can receive the multicast packets. This type of defect corresponds to CWE‑908. Based on the description, the attack vector appears to require the ability to subscribe to the XFRMNLGRP_EXPIRE netlink group, which generally means local or privileged access.

The vulnerability exists in Linux kernel versions that have not yet incorporated the patch for build_polexpire(). Specifically, release candidates of the 2.6.12 series (rc1 through rc5) and of the 7.0 series (rc1 through rc7) contain the vulnerable code. The fix was merged into mainline Linux (commit 71a98248) and is included in all kernels released after that commit.

The CVSS base score of 5.5 indicates medium severity. The EPSS score of less than 1% suggests that the likelihood of exploitation in the wild is low. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require an attacker to observe or inject into the XFRMNLGRP_EXPIRE netlink multicast traffic, which typically implies local or privileged user context. Consequently, the overall risk is moderate, but the expected probability of successful exploitation is low.