The vulnerability arises because tc_chain_fill_node never initializes the 4‑byte tcm_info field of struct tcmsg. When the kernel builds netlink messages the buffer is allocated but not zeroed, so parts of kernel heap memory are injected into userspace. Based on the description, it is inferred that an attacker with local access can invoke a netlink tc_* operation that calls tc_chain_fill_node and read the leaked tcm_info data, exposing sensitive kernel state. This is an uninitialized memory bug (CWE-908) that poses a confidentiality risk.

The flaw exists in the Linux kernel in all releases prior to the commit that zeroes tcm_info. The fix is distributed in the mainline kernel; any distribution that still ships its own unpatched kernel is vulnerable. Administrators should confirm that their current kernel includes the commit referenced in the kernel git links.

The CVSS score is 5.5 and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is inferred to be local: a process that can send or receive netlink traffic to the tc_ interface may trigger tc_chain_fill_node and observe the leaked tcm_info field. Exploitation requires at least local privileges or control over netlink traffic, but no public exploits have been documented, so the probability of exploitation remains low.