The kernel component ieee802154 uses a structure to represent a radio address; when the address mode is set to IEEE802154_ADDR_NONE the pan_id field is left uninitialized. The uninitialized field is later copied into a user‑space sockets structure via dgram_recvmsg, allowing whatever data happened to reside in that stack location to be leaked to a user process. This flaw is therefore a kernel information disclosure that can reveal sensitive kernel data but does not grant code execution or modification of kernel state.

The flaw exists in any Linux kernel that implements the ieee802154 stack and has not applied the fix that zeroes the address structure in ieee802154_hdr_get_addr. No specific version range is listed, so any legacy kernel prior to the commit that performs the zeroing is potentially impacted.

The vulnerability has a CVSS score of 5.5 and an EPSS score of <1%, indicating a moderate severity and low likelihood of exploitation. It is not listed in the CISA KEV catalog. The likely attack vector is inferred to be network‑based: an adversary would need to transmit a specially crafted IEEE 802.15.4 packet with the NONE address mode to the target device. This requires wireless access to the local network segment and the ability to inject packets into the ieee802154 interface. While the information disclosure could be valuable, the lack of a publicly available exploit and the need for targeted packet injection imply a moderate likelihood of exploitation in high‑confidentiality environments.