This vulnerability occurs in the Linux kernel rnbd server when the response buffer is used without zeroing it, allowing stale data from previous protocol exchanges to leak to a client. The result is that a client can read data that it should not have access to, thereby exposing confidential information. No integrity or availability impact is described in the available information.

All Linux kernels that run the rnbd server are potentially affected; the exact versions are not listed, so any kernel containing the unpatched rnbd_s code should be considered at risk until the patch is applied.

There is no EPSS score or CVSS value provided, and the vulnerability is not listed in CISA KEV. Because the bug involves a memory leak within kernel space, the most likely attack vector is a local attacker with kernel privileges or a victim of a kernel exploitation that can read the leaked buffer. The lack of detailed metrics suggests a moderate risk, but any exploitation would compromise confidentiality.