The MCTP‑I2C driver in the Linux kernel is prone to returning an uninitialised byte when an I2C read is performed. Because the driver fails to set the return value to 0xFF, a stack‑allocated byte that was never written to may be leaked to the caller. This results in the disclosure of a single, uncontrolled byte of data, which is insufficient for arbitrary code execution but may aid in memory‑analysis or side‑channel attacks. The weakness is classified as CWE‑908 Uninitialised Information Leak.

All versions of the Linux kernel that contain the unpatched MCTP‑I2C driver and enable the i2c‑aspeed or i2c‑npcm7xx sub‑drivers are affected. The vendor list includes the general Linux operating system; the CPE indicates the kernel component. No specific version range is supplied, so any kernel build without the fix should be considered vulnerable if the affected driver modules are present.

Based on the description, it is inferred that an attacker would need the ability to issue I2C read commands against an MCTP device, typically requiring local or physical access to the machine. The EPSS score is under 1 % and the vulnerability is not listed in the CISA KEV catalog, suggesting a low likelihood of exploitation. Although the exposure is limited to a single byte, the need for privileged bus access and the low exploitation probability mean the overall risk is low to moderate.