The vulnerability resides in the Linux kernel’s handling of IPv6 Router Advertisements that contain user options. When such a message is processed, the kernel constructs a netlink message (RTM_NEWNDUSEROPT) containing a structure with three padding fields that are never initialized. An attacker can read these uninitialized fields, causing kernel memory contents to be exposed outside the kernel. The primary impact is an information disclosure which could reveal sensitive kernel data to the adversary. The weakness is an instance of uninitialized memory usage leading to data leakage.

All Linux kernel installations that include the unpatched form of the ndisc_ra_useropt routine. The specific CVE references the underlying commit changes, but exact version ranges are not enumerated in the data. Systems running any kernel that has not applied the patch from the provided git commits are potentially vulnerable.

The CVSS score of 7.1 indicates a moderate to high risk for this vulnerability. The EPSS score of 0.032% indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The vulnerability is likely exploitable remotely over a network by an attacker who can inject crafted IPv6 Router Advertisements targeting the vulnerable host. The uninitialized padding fields provide a read‑only vector for kernel data leaks. As the attack requires only network‑level communication, the attack vector can be inferred to be remote network. The lack of documented exploitation mitigates the immediate threat, but the presence of the flaw warrants prompt remediation.