The Linux kernel function rtnl_fill_vfinfo allocates a structure on the stack without initializing it, then copies only a partial Ethernet broadcast address into the structure; the remaining 26 bytes retain whatever data happened to be on the stack. When a local user sends a RTM_GETLINK request containing the IFLA_EXT_MASK option for virtual functions, the kernel emits the uninitialized portion of the structure back to user space, leaking up to 26 bytes of kernel stack per VF. This vulnerability enables an unprivileged local process to read arbitrary kernel‑stack data, potentially including return addresses or other sensitive information, but does not grant code execution or direct privilege escalation.

All Linux kernel implementations that include the rtnl_fill_vfinfo routine are affected, since the vendor information lists the product as Linux:Linux with no version bound. The leak demonstrates up to 26 bytes of stack residue per VF on Ethernet devices that support SR‑IOV, common in many server NICs. No specific kernel release is identified in the data, implying that every pre‑patched kernel is potentially vulnerable.

The vulnerability is exploitable locally: any unprivileged process can open an AF_NETLINK socket and send a RTM_GETLINK message with IFLA_EXT_MASK, a capability that requires no special privileges. The stack leak is repeatable and may expose kernel addresses or transient data, raising the risk of further attacks. The CVSS score is 7.0, the EPSS score is < 1%, and the flaw is not listed in the CISA KEV catalog, but the local delivery vector makes it a realistic threat for targeted attacks.