The vulnerability allows an attacker to trigger an out‑of‑bounds read in the Linux kernel's netconsole subsystem when a non‑null‑terminated message is processed. The read can expose arbitrary bytes from the kernel heap, potentially leaking sensitive data or enabling further exploitation. The issue is classified as a Buffer Overread (CWE‑119) and can cause kernel crashes observed in KASAN traces.

Affected systems are Linux kernel installations that include the netconsole feature prior to the patch implementing commit 7eab73b18630. The vulnerability is present in any kernel version that exposes the netconsole console infrastructure without enforcing null termination on messages. The specific versions impacted are not enumerated in the advisory, but all kernels before the fix are potentially vulnerable.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating limited public exploitation evidence. However, the exploit requires either local privileged access or remote control of the netconsole interface, making it a moderate to high risk for systems that expose netconsole to untrusted networks. The KASAN log shows that the read occurs within the netconsole_write routine, which is executed when console data is transmitted to the network, so protective measures that restrict console access can reduce the attack surface.