The flaw lies in the Linux kernel’s hwmon subsystem for the ADM1266 power‑management device. When the device returns fewer than the expected two bytes for GPIO status, the kernel concatenates uninitialized read buffer values to form a pin‑status word. This composed word can contain kernel stack data, which then flows through set_bit() into the generic GPIO interface. The result is a small information‑disclosure vulnerability that leaks a handful of kernel stack bits to user space via sysfs and the character‑device ioctls. The weakness is a source‑validation failure and is classified as CWE‑824.

The vulnerability affects any Linux kernel installation that includes the adm1266_gpio_get and adm1266_gpio_get_multiple implementations. All current and future kernel releases containing the unsupported code are potentially impacted; the advisory does not list specific release numbers, so patches must be applied to any affected kernel version.

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of less than 1 % and absence from the CISA KEV catalog suggest a low probability of public exploitation at this time. An attacker would need to control or spoof an I2C/PMBus slave capable of delivering a short block‑read response, which typically requires physical or firmware access to the device. This inference about the attack vector is based on the description and is not explicitly stated in the advisory.