The Linux kernel’s XFRM component contains a data structure that, when reported via build_report(), is copied to userspace without zeroing its three padding bytes. Those bytes can contain leftover kernel data, allowing an attacker to read arbitrary kernel memory. This constitutes an information‑disclosure flaw classified as a memory‑leak (CWE‑401). The vulnerability reveals private data that can be used to assist further attacks rather than directly escalating privileges.

All Linux kernel releases that predate the patch through commit 0616314b3b34f24cbb91da8c6bd8bcdc4c8592f9 are affected, including the 2.6.19 series and the 7.0 release candidates (rc1 through rc7). A system running any of these kernel versions without the fix is susceptible; newer mainstream releases that incorporate the commit are not affected.

With a CVSS score of 5.5 the vulnerability is of moderate severity. The EPSS score of less than 1% indicates a very low probability of exploitation in the wild, and it is not listed in the CISA KEV catalog. Exploitation would most likely occur through the XFRM subsystem, which is normally restricted to privileged users or processes with specific capabilities. While the flaw does not provide direct privilege escalation, the information exposed could aid an attacker in constructing more damaging exploits.