A race condition in the Linux kernel's Industrial I/O (IIO) event handling path allows a user thread to obtain a newly allocated file descriptor before the FIFO is reset. While the FIFO reset occurs, another thread can read from the file descriptor. The read path may advance the FIFO pointer using stale state, potentially leaving the output index past the input index. Subsequent reads can therefore copy more data than the buffer holds, leading to an out‑of‑bounds read of kernel memory which is then exposed to user space. The vulnerability enables information disclosure of kernel contents, including potentially sensitive data.

The flaw is present in all versions of the Linux kernel that include the IIO event driver prior to the commit that reordered the FIFO reset and the file descriptor allocation. These include the current stable releases as well as all upstream kernels that had not yet incorporated the patch. Because the affected code is part of the generic IIO subsystem, any system that exposes the IIO event device nodes (/dev/iio/eventX) to a user process is susceptible. No specific vendor product list beyond the Linux kernel is enumerated, so all distributions shipping the vulnerable kernel code are impacted.

The CVSS base score of 7.1 classifies it as high severity, while the EPSS score of <1% implies a very low predicted probability of exploitation. The flaw requires a local user to race against the kernel’s FIFO reset, which is generally only possible when the user can open and read the IIO event file. No active exploits have been disclosed and the issue is not listed in CISA’s KEV catalog, suggesting limited threat activity. Nonetheless, systems that expose the IIO event interface to untrusted users or invite local users with elevated privileges face elevated risk; patching promptly mitigates any potential memory disclosure.