The Linux kernel’s EVM subsystem contains a flaw in evm_read_xattrs() where a buffer of size plus one bytes is allocated but never initialized before a strlen() call. When no extended attributes are enabled the buffer holds garbage, and strlen() traverses uninitialized memory, potentially exposing kernel memory contents to a user process. A fault could also occur if the read reaches an invalid memory region, possibly destabilizing the kernel.

All Linux distributions that ship the unpatched EVM module and kernel code are affected. The vulnerability is not confined to a specific kernel release; any build that contains the pre‑fix code paths is susceptible. If the system’s kernel has not been updated with the upstream change that properly terminates the buffer and uses snprintf(), the system remains vulnerable.

The flaw is local; an attacker needs the ability to read EVM extended attributes on a file, typically granted to processes with file access rights. No public remote exploitation pathway is known. The CVSS score of 5.5 indicates moderate impact, and the EPSS score of < 1% suggests a low probability of exploitation. The issue is not listed in the CISA KEV catalog. The primary risk is information disclosure for environments that use EVM attributes, with limited impact otherwise.