The vulnerability originates from the PF_KEY export paths in the Linux kernel where a 4‑byte region of the IPv6 sockaddr structure is left uninitialized. Because pfkey_sockaddr_fill() only zeroes the first 28 bytes of a 32‑byte payload, the remaining aligned bytes may contain memory from previous kernel activity. An attacker who can trigger a PF_KEY message such as SADB_ACQUIRE or the newer NAT T mapping extensions could observe these garbage bytes, potentially leaking sensitive kernel data. This flaw is an instance of Uninitialized Memory usage (CWE‑796).

Affected systems are Linux kernel implementations that implement the af_key interface before the patch that clears the aligned tail. The issue is present in all release series before the commit referenced in the provided git patches, possibly including kernels older than 5.15. There are no version numbers specified, but the flaw was identified in the official kernel codebases.

The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog, suggesting that it has not yet been widely exploited. The risk is moderate because exploitation requires an attacker to reach the PF_KEY socket and trigger one of the specific export paths. However, the leak could aid an attacker in gathering kernel memory contents, which can be useful for further privilege escalation. Immediate application of the upstream patch is the recommended way to eliminate the uninitialized memory region.