The flaw resides in the Linux kernel’s hardware monitoring subsystem for the ADM1266 power‑management device. When a device returns fewer bytes than the two expected for GPIO status, the code concatenates the uninitialized read buffer without performing a length check, forming a pin‑status word that may contain kernel stack data. These bits are then passed to user space via the generic GPIO interface, leaking a small amount of kernel memory. This results in an information‑disclosure vulnerability that can expose sensitive data from the stack, potentially assisting an attacker in crafting further exploits. The weakness is classified as CWE‑824, reflecting an improper check of source or sink data.

The vulnerability affects the Linux kernel; specific kernel releases are not enumerated in the advisory, so it applies to all current and future builds that contain the unsupported adm1266_gpio_get and adm1266_gpio_get_multiple implementations.

According to the available metrics, the EPSS score is below 1 % and the vulnerability is not listed in the CISA KEV catalog, indicating a low probability of public exploitation. An attacker would need to control or spoof an I2C or PMBus slave that can deliver an unexpectedly short block‑read response, which typically requires physical or firmware access to the device. If such control is achieved, the attacker could read kernel stack contents in user space but would still be limited to the few leaking bits exposed through the GPIO sysfs or ioctl interfaces.