The vulnerability occurs in the Linux kernel’s MCTP I2C driver. When reading from an MCTP‑I2C device, the driver mistakenly returned the raw value from the I2C bus driver rather than initializing it to 0xff. For the i2c‑aspeed and i2c‑npcm7xx drivers, that value is an uninitialized stack byte. An attacker that can read from the I2C bus could therefore receive arbitrary data from kernel memory, potentially leaking sensitive information. The patch changes the path to return 0xff for these reads, eliminating the uninitialized data exposure.

All Linux kernel builds that include the MCTP I2C driver prior to the applied patch. The vulnerability does not affect non‑MCTP I2C drivers. No specific kernel version range is listed, so any kernel distribution that contains the affected code before the fix is at risk.

The CVE does not have a published CVSS or EPSS score and is not listed in the CISA KEV catalog. The flaw is a read of uninitialized stack data, which is generally considered a low‑to‑medium impact vulnerability. Exploitation would require the attacker to communicate with the I2C bus that hosts an MCTP device, which typically implies local or physical access to the machine. Accordingly, the risk level is considered moderate, and the probability of widespread exploitation is expected to be low.