The flaw originates in the Linux kernel’s PF_KEY export routine where IPv6 socket address entries are only partially initialized. The final four bytes of the 32‑byte IPv6 address payload remain uninitialized, potentially exposing kernel memory contents. Based on the description, it is inferred that an attacker who can trigger the affected export paths—such as SADB_ACQUIRE, SADB_X_NAT_T_NEW_MAPPING, or SADB_X_MIGRATE—may read these garbage bytes, leading to information disclosure.

Affected systems are Linux kernel implementations that use the af_key interface and have not yet incorporated the commit that clears the aligned tail of the sockaddr payload. The absence of explicit version details leads to the inference that all distributions running unpatched kernel versions prior to the referenced commit are vulnerable.

The CVSS score of 5.5 denotes moderate severity. The EPSS score is below 1%, indicating a very low but non‑zero likelihood of exploitation. The vulnerability is not listed in CISA KEV, suggesting that it has not been widely exploited. Based on the description, it is inferred that an attacker must have the ability to interact with the PF_KEY socket and invoke the affected export paths for the leak to occur; this requirement reduces the overall risk but the potential for revealing kernel data warrants prompt remediation.