The Linux kernel’s J1939 transport layer does not zero the allocated receive buffer in j1939_session_fresh_new(). As a result, data from a previous session may remain in memory and could be read by later operations. This residual data can expose content that was not intended for the current session, potentially revealing sensitive information transmitted over the CAN network. The weakness is a form of information exposure that leaks memory contents to higher‑level code that expects a fresh buffer.

All Linux kernel distributions that include the default J1939 implementation are affected. No specific version range is listed in the advisory, but the problem existed until the commit that added buffer zeroing, so older kernels that have not received that patch remain vulnerable.

The CVSS score is 7.5 and the EPSS metric is < 1%, so the risk is evaluated based on the description. Because the vulnerability requires the attacker to be able to initiate a new J1939 session and read the receive buffer, the attack vector is likely local or requires control over the CAN interface. The impact is information disclosure rather than denial of service or code execution. Given the lack of public exploit evidence and the need for local or privileged interaction, the overall risk is considered low to moderate.