The Linux kernel issue leaves one to three bytes of padding after the TCP‑AO MAC uninitialized when constructing standalone responses. This residual data is copied into the packet header and may be transmitted over the network, allowing a remote observer to see previously unexposed kernel memory content. The vulnerability does not provide an attacker with code execution or direct control; its effect is limited to leaking small amounts of data.

All Linux kernel releases before the patch commit (c/a859b280441fb02f64ed4037f03d5c0c34a7a595) are affected. The flaw resides in the TCP layer of the kernel, so every Linux system running an unpatched kernel is potentially vulnerable.

The CVSS score of 7.5 denotes high severity, while the EPSS score is very low (<1%). The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker can trigger the vulnerable path by initiating a network request that causes the kernel to generate a TCP‑AO response – for example, connecting to a service that uses TCP‑AO authentication. This attack does not require elevated privileges and can be performed remotely over the network. The likelihood of exploitation is low, but because the data that can be leaked originates from the kernel, routine information disclosure remains a concern for exposed systems.