The vulnerability arises in the Linux kernel's HFS/HFS+ filesystem drivers when the function hfs_bnode_read exits early without writing to its output buffer if validation checks fail. Callers that use stack‑allocated buffers then treat the returned data as fully initialized, resulting in a read of uninitialized memory. This uninitialized‑read flaw, identified as CWE‑908, could allow an attacker to expose kernel data or trigger unpredictable kernel behaviour. It does not grant direct code execution but may lead to information disclosure or subtle crashes.

All Linux kernel releases before the commit fixing the zero‑initialization of the buffer in hfs_bnode_read are affected. This includes the hfs and hfsplus filesystem modules shipped by any distribution that has not applied the patch. The vulnerability applies to all systems that mount or access HFS/HFS+ volumes using the vulnerable kernel.

The EPSS score is below 1% and the vulnerability is not listed in CISA KEV, indicating a low probability of exploitation at present. The likely attack vector is local privileged access, such as a user who can mount a malicious HFS/HFS+ volume or otherwise trigger reads through the vulnerable code. The attacker would need to influence filesystem reads to cause the kernel to propagate uninitialized data, potentially leaking kernel memory or causing a panic. This inference about the attack vector is based on the description of how the flaw is triggered, as the CVE data does not explicitly state the required access level.