The vulnerability resides in the Linux kernel’s rseq subsystem; a bug allows an uninitialized stack variable, struct rseq_ids ids, to be used before its field node_id is properly set. Because the compiler may evaluate cpu_to_node(ids.cpu_id) before ids.cpu_id is assigned, node_id can contain an indeterminate value, leading to a kernel‑information leak when rseq_set_ids_get_csaddr is invoked. The weakness is an uninitialized variable usage (CWE‑682).

All Linux kernel releases before the patch are affected. The vendor is Linux, product is the Linux kernel, and no specific version range is provided. Users should update to a kernel containing the commit that moves the assignment of ids.node_id outside the structure initialization.

The CVSS score is not publicly available, and the EPSS score is not currently provided; the vulnerability is not listed in CISA KEV. However, kernel information leakage can expose sensitive data and potentially enable further privileged attacks, giving the risk a substantive level. Exploitation would generally require local or privileged execution to trigger rseq paths, so it is more a local kernel component issue than a remote exploit. No publicly known exploit exists at this time, but the lack of a precise EPSS score indicates that exploitation is possible and should be treated as moderate to high severity.