The vulnerability arises from uninitialized variables used during the GSSAPI key exchange in the OpenSSH server. When an attacker sends an unexpected GSSAPI message type, the server uses sshpkt_disconnect() which does not terminate the connection. This allows the code to use related connection variables that were never set to NULL, leading to random memory access and undefined behavior. The impact can include accidental disclosure of memory contents or a denial of service if the undefined behavior crashes the process. The weakness corresponds to CWE‑824 and CWE‑908.

Affected systems are Ubuntu distributions that include the patched OpenSSH GSSAPI implementation. The issue is limited to OpenSSH packages customized by Ubuntu; the upstream OpenSSH project is not affected. No specific affected version numbers are enumerated in the available data, so any Ubuntu OpenSSH release that includes the distribution's GSSAPI patch is potentially vulnerable.

The vulnerability has a CVSS score of 2.7 and an EPSS score of less than 1 %, and it is not listed as a Known Exploited Vulnerability. Exploitation requires network access to an SSH server and the ability to send crafted GSSAPI messages. It may expose sensitive data or cause a service disruption, especially on systems with weaker compiler hardening. The recommended mitigation is to update to an Ubuntu OpenSSH package that contains the patch or to apply an alternative code change that forces proper process termination on error.