A fault in the Linux kernel caused a local variable to remain uninitialized before the function vfs_fileattr_get was invoked, as discovered by KMSAN in a FUSE file attribute retrieval call. The defect is an Uninitialized Variable use vulnerability that may result in the kernel reading garbage data, leading to unpredictable behavior or the accidental exposure of kernel memory contents. The CVE description does not explicitly confirm concrete disclosure or denial‑of‑service scenarios, so any impact is inferred from the nature of the fault.

All Linux kernel releases before the commit that added initialization of the flags_valid flag (identified by commit c379e19e820dd1c6145426b97467728b3b89c0b42) are affected. The vulnerability applies to the Linux kernel itself, regardless of the distribution, as the kernel source is shared across distributions.

No CVSS score has been published for this issue, but the EPSS score is reported as < 1 %, indicating a very low probability of exploitation. It is not listed in CISA’s KEV catalog. The defect can be triggered only with local system access that allows file attribute operations, so the attack surface is limited to local users who can invoke getattr or related syscalls. Overall, the risk is considered low to moderate, primarily due to the low exploitation probability and local nature of the flaw.