The flaw occurs when nft_exthdr_init passes a user‑controlled length value to nft_parse_register_store, marking multiple registers as initialized. When the F_PRESENT flag is set, evaluation writes only a single byte or zeros a four‑byte area; registers beyond the first are never written, leaving uninitialized stack data in nft_regs that can be read by an attacker, exposing kernel memory. This follows CWE‑824 (incorrect handling of absent data) and CWE‑908 (use of uninitialized data).

All Linux kernel variants that include the nft_exthdr extension without the recent bug‑fix, including mainstream releases and the 7.1 release candidates (rc1‑rc7). Any system running the netfilter framework with nft_exthdr active is affected, regardless of distribution.

The CVSS base score of 5.5 indicates a medium severity. EPSS is below 1 %, implying a low current exploitation probability, and the vulnerability is not listed in CISA KEV. No public exploits are known. The likely attack vector requires a local user or process with sufficient privileges to inject or modify nft rules, making remote exploitation unlikely. Consequently, the risk is confined to potential information disclosure rather than arbitrary code execution.