The vulnerability allows an unprivileged local process to read uninitialized bytes from a Bluetooth ISO socket structure. The kernel returns a partially filled sockaddr_iso through getsockname() or getpeername() without clearing all bytes, so the trailing pad byte and, in broadcast cases, several initial bytes of the broadcast structure are leaked. This results in the disclosure of internal kernel memory contents to the caller, providing an information‑exposure vector that could assist further attacks such as memory‑layout inference.

The affected code is part of the Linux kernel Bluetooth ISO subsystem. All Linux distributions that ship kernel versions prior to the patch referenced in the CVE, regardless of vendor, are potentially impacted. Any system that has BTPROTO_ISO sockets enabled and employs the getsockname()/getpeername() system calls is in the danger zone.

The CVE does not have a published CVSS score and the EPSS score is not available, indicating that detailed quantitative risk data is missing. The vulnerability is not listed in CISA's KEV catalog. The described attack requires only a local unprivileged user to open a BTPROTO_ISO socket and invoke getsockname(); no network or elevated privileges are needed. Consequently, the attack surface is limited to the local system, but the exposure of kernel memory poses a non‑negligible confidentiality risk to the affected machine.