The CDC‑WDM driver in the Linux kernel contains a reordering bug where the descriptor length is updated before a memcpy operation. If the write to the length field is reordered ahead of the memmove, the read handler may see an incorrect length and then call copy_to_user() on memory that has never been initialized. This causes uninitialized kernel data to be copied into user space, potentially exposing sensitive information or causing a crash. The issue also violates Linux Kernel Memory Model data‑race rules, indicating a concurrency flaw.

All Linux kernel builds that contain the CDC‑WDM driver and lack the patch from the referenced commits are vulnerable. The advisory does not list exact release numbers, but any kernel version prior to the inclusion of the fix is considered at risk.

The CVSS score of 7.0 indicates a high severity vulnerability, and the EPSS score is 0.00024, indicating a very low probability of exploitation. The flaw is not listed in the CISA KEV catalog. Exploitation would require an attacker to trigger a CDC‑WDM read operation, so the attack vector is inferred to be local or remote device access. While the flaw does not grant remote code execution, it can lead to information disclosure or a denial‑of‑service condition if the user space copy causes a fault.