The vulnerability resides in the Linux kernel’s mctp driver, specifically in its netlink interface. A crafted RTM_GETNEIGH request can elicit a kernel response whose pad bytes of the ndmsg structure are not initialized. This causes uninitialized kernel data to be copied to user space via the netlink reply, potentially revealing arbitrary kernel memory contents. The vulnerability is a form of information disclosure (CWE-824).

All Linux kernel versions that contain the mctp driver before the commit that zero‑initialises the nlmsg responses are affected. No specific version numbers are listed in the advisory, so the flaw may exist in any kernel prior to those commits referenced.

No CVSS score is published and the EPSS score indicates a very low probability of exploitation (<1%). The vulnerability is not listed in the CISA KEV catalog. The risk depends on an attacker’s ability to send a malicious RTM_GETNEIGH request and the presence of uninitialized data in the reply. Because the likelihood of exploitation is currently unknown and no exploit has been publicly disclosed, the overall risk is uncertain but the potential for confidential data leakage warrants timely remediation. It is inferred that elevated privileges may be required to generate the request, but this is not explicitly confirmed.