The vulnerability arises from the tc_chain_fill_node function in the Linux kernel not initializing the tcm_info field of struct tcmsg. Because the buffer is allocated without zeroing, parts of kernel heap memory are exposed to userspace through netlink messages, allowing local processes to read unintended data. This leakage presents a confidentiality risk and is an instance of an uninitialized memory bug (CWE-788).

The flaw exists in the Linux kernel wherever the tc_chain_fill_node routine is unmodified. The specific kernel releases affected are not enumerated in the advisory, so any kernel version lacking the zeroing patch is considered vulnerable. Administrators should verify whether their installed kernel contains the commit referenced in the provided links.

The CVSS score is not supplied, and the EPSS score is unavailable; the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local, where a process can send or receive traffic that triggers tc_chain_fill_node and read the leaked tcm_info field. While the exploitation requires local privileges or control over netlink traffic, the impact is unauthorized disclosure of kernel data. Given the lack of publicly demonstrated exploits, exploitation probability is considered low but non-zero.