The flaw allows a kernel memory region that is not page aligned to be mapped into user space, causing the kernel to expose protected information. The root cause is that bounce pages allocated for the VDUSE interface are not zeroed before being exposed to user processes, so residual kernel data can be read. This is a pure information‑leak vulnerability that can reveal sensitive internals of the operating system.

All Linux kernel deployments are potentially affected, as the issue resides in core kernel code. No specific version list is provided, so any release built against the unpatched kernel source may suffer. Administrators should review their distribution’s patch status and verify whether the VDUSE path is enabled.

The CVSS score is 5.5, indicating a moderate risk. The EPSS score is < 1%, suggesting a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitability requires local or trusted access to trigger the VDUSE path and map the bounce pages; if the kernel is not configured to zero those pages, an attacker could read sensitive kernel memory, resulting in confidentiality loss. Because the information leakage is limited to those bounce pages, the impact is confined to kernel data, but it remains a significant vulnerability for any system that exposes VDUSE to untrusted users.