In Linux kernel versions before the recent fix, the Industrial I/O core subsystem fails to initialize a buffer when a debugfs write is attempted from a non‑zero file offset. The function does not set the start of the buffer, leading to the use of uninitialized data. This flaw can allow a privileged process to read unintended kernel memory or exercise unpredictable behavior within the subsystem, potentially leaking information.

The issue affects all Linux kernel builds that include the Industrial I/O core subsystem and expose the debugfs interface. Any kernel revision prior to the commits referenced in the official kernel change log is vulnerable; the affected vendor is Linux and the affected product is the Linux kernel.

The weakness is a kernel memory leakage fault (CWE-824). The CVSS score of 5.5 indicates a medium severity. The EPSS score of <1% suggests a low likelihood of exploitation. The vulnerability is not listed in CISA KEV. Exploitation requires write access to the debugfs filesystem, which typically requires a privileged user or an attacker who can mount debugfs. Successful exploitation could lead to information disclosure or a local denial of service.