The rnbd server in the Linux kernel reuses the response buffer without clearing it before sending data back to the client. As a result, leftover data from previous protocol exchanges can be returned to the client when legacy protocol versions are used. This can reveal sensitive information that should not be exposed, leading to a disclosure of confidential data.

The flaw exists in the rnbd server component of the Linux kernel. All kernel releases that have not yet incorporated the patch that zeroes the response buffer are vulnerable. Since the affected product is the generic Linux kernel, any system running an unpatched kernel version with the rnbd service enabled is at risk.

The EPSS score for this vulnerability is < 1% and it is not listed in the CISA KEV catalog, indicating no known public exploitation. The CVSS score is 7.5, indicating a moderate to high severity. The likely attack vector is inferred to require triggering the rnbd service from within the kernel, typically through local or privileged access, or by a remote attacker who has already achieved kernel execution. Because the vulnerability can only be exploited when the rnbd service processes a request, it is considered a local or privilege-based threat with a moderate likelihood of exploitation pending additional context.