The kernel’s io_uring waitid operation can return without populating a result structure when no child event occurs, yet the code copies that uninitialized structure to user space. This exposes stale kernel memory contents to the calling process, allowing an attacker to leak arbitrary data from the kernel. The flaw does not directly allow code execution but can aid in reconnaissance or privilege escalation by revealing secret information.

All Linux kernel implementations that include the io_uring subsystem and have not applied the fix referenced in the commit logs. The CVE description does not specify exact version ranges, so any kernel lacking the update is potentially vulnerable. Administrators should verify the kernel version and consult the vendor’s patch notes.

The vulnerability can be exercised by a local user that has permission to create an io_uring instance and submit a WAITID request. Because the information exposed stems from kernel memory, an attacker could gather sensitive data. The flaw has a CVSS score of 5.5, and the EPSS score is less than 1%. No public exploits are recorded. The KEV catalog does not list the vulnerability, suggesting it has not been actively exploited in the wild. However, the potential for information disclosure warrants prompt patching, especially in environments handling sensitive data.