The TI icssg-prueth driver for Linux implements a zero‑copy (ZC) receive path that allocates a socket buffer but fails to copy incoming packet data from the XDP buffer into the buffer before it is passed up the networking stack. As a result, the buffer contains uninitialized kernel heap memory that is exposed to user space, leaking kernel heap contents. Additionally, the driver incorrectly marks the buffer as recyclable with skb_mark_for_recycle, even though it is backed by a NAPI page fragment allocator rather than the page_pool. This mis‑recycling can corrupt page_pool state. The vulnerability is an information‑disclosure flaw due to a data‑copy oversight.

All Linux kernel releases that include the TI icssg-prueth driver before the fix are vulnerable. No specific kernel version ranges are listed in the disclosure, so any build containing the unpatched driver is impacted.

The CVSS score of 9.8 reflects the severity of the flaw. The EPSS score of < 1% indicates a very low but non‑zero likelihood of exploitation, and the vulnerability is not yet listed in the CISA KEV catalog. The likely attack vector is inferred to involve sending crafted packets to the interface that employs the ZC receive path, requiring access to that network device—typically available to the local host or to an attacker who can transmit traffic to the interface. An attacker who successfully triggers the flaw can read arbitrary kernel heap data, which could aid subsequent privilege escalation or data tampering attacks. Because the exploit requires packet injection and specific driver state, widespread exploitation is considered low at this time, but the disclosure impact remains critical.