The vulnerability resides in the Java TLS ioctl probe of OpenTelemetry eBPF Instrumentation, where user-controlled ioctl pointers are read with bpf_probe_read instead of the safer bpf_probe_read_user. When an instrumented local process supplies a pointer that references kernel memory, that memory is copied into telemetry data, leading to the disclosure of sensitive kernel contents and a confidentiality compromise of the host.

OpenTelemetry eBPF Instrumentation is affected across all releases before version 0.9.0. The issue is fixed in release 0.9.0 and later.

The CVSS score of 3.8 indicates a low overall severity, reflecting that the flaw requires a local instrumented process with control over the Java TLS ioctl probe to trigger the memory disclosure. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation. Attackers need local, privileged access to the instrumentation process to supply the controlled pointer; without this, the risk remains low.