The Linux kernel bug leaves one to three bytes of padding after the TCP‑AO MAC uninitialized when constructing standalone TCP responses. The uninitialized memory is copied into the packet header and can be transmitted over the network. Based on the description, those bytes may contain random kernel data, potentially exposing sensitive information to a remote observer. The impact is limited to data leakage; no direct control or code execution is achieved by the attacker.

All Linux kernel releases prior to the fix are affected. The offending code resides in the TCP layer of the kernel and therefore applies to any Linux system running a kernel without the pending patch.

The CVSS score is not provided and the EPSS metric is not available, so precise exploit probability cannot be calculated. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote, network‑based request that triggers the kernel to send a TCP‑AO response—i.e., an unprivileged user need only connect to a service that uses TCP‑AO to provoke the vulnerable path. While the exact risk depends on network exposure, the potential for routine information disclosure warrants moderate to high concern for exposed systems.