The flaw resides in the sixpack_receive_buf() function of the Linux kernel hamradio driver. The loop that iterates over TTY error flags fails to advance the data pointer, so bytes marked as erroneous are still passed to sixpack_decode(). Because the TTY layer does not guarantee that the data byte is valid when an error flag is set, the decoder processes uninitialized memory. This results in a KMSAN report of an uninitialized value read, indicating that the driver may behave unpredictably if it encounters malformed input. The immediate consequence is a diagnostic report; the description does not document a crash or memory corruption, but the presence of an uninitialized value read can lead to undefined behavior in kernel code that subsequently consumes that data.

The vulnerability affects the Linux kernel hamradio network driver as implemented in all kernel releases that do not yet include the patch found in the advisory commit references. Administrators should verify that their running kernel contains the commit that fixes sixpack_receive_buf. The affected vendor is Linux, product Linux kernel.

The EPSS score is below 1%, indicating a very low probability of exploitation. The CVSS score of 5.5 represents moderate risk. The vulnerability is not listed in CISA KEV. Based on the description, it is inferred that an attacker would need to send a specially crafted hamradio packet that reaches the uninitialized-value code path in the driver. This could trigger KMSAN reports or potentially lead to undefined behavior in kernel components that consume the decoded data. No public exploits or crash evidence have been reported, and the impact appears limited to diagnostic reporting and possible downstream instability.