The vulnerability resides in the Linux kernel’s xfrm_user interface. A one‑byte padding hole in struct xfrm_usersa_id is left uninitialized before the structure is copied to userspace by build_mapping(). This allows a process that invokes the relevant ioctl to read uninitialized kernel data, leaking sensitive information and constituting an information exposure flaw caused by use of uninitialized memory.

Affected Linux kernel versions are not explicitly enumerated in the CVE data. The bug exists in any kernel that retains the uninitialized padding in struct xfrm_usersa_id before the build_mapping() routine copies data to userspace. Devices running a kernel that has not yet been patched to zero the structure are at risk. The patch that clears the padding has been merged into recent kernel releases, so updating to a kernel version that includes this change provides remediation.

The CVSS score is not disclosed and the EPSS is unavailable, so the public data does not provide a quantified severity or likelihood. The attack appears to be local: a privileged or compromised local process can trigger the offending ioctl and read the uninitialized padding without requiring higher kernel privileges. No known exploitation has been reported in the CISA KEV catalog. While the confidentiality impact could aid follow‑on attacks, the exploitability requires local access to invoke the kernel interface.