The vulnerability arises when the NFC subsystem parses an RF discover or activated notification packet without zero‑initialising the on‑stack structure that holds technology‑specific parameters. If the packet indicates zero length, the union within the structure remains uninitialised. Subsequent processing passes this stale data to a helper that copies content into a kernel target list and subsequently exposes it to user space via the NFC_CMD_GET_TARGET ioctl. This flow can leak uninitialised stack data, which may contain sensitive information. The flaw does not directly provide code execution but can divulge kernel memory to privileged user space, constituting an information‑disclosure risk.

Affected realisations are Linux kernel builds that include the NFC (nci) driver before the patch commit that added proper zero‑initialisation to the on‑stack notification structures. Kernels preceding the commit address in the included references are therefore vulnerable. No official version range is listed, so all versions lacking this patch should be considered at risk.

No explicit CVSS score is provided and the EPSS value is not available, so the quantitative severity and exploitation probability are unknown. The bug requires a user to invoke the NFC subsystem, making it a local‑privileged attack surface. Because the kernel copies the uninitialised data and returns it through a user‑space interface, the attack does not lead to remote code execution, but it can expose sensitive stack contents to that user. The risk is moderate: the impact is limited to information disclosure, and exploiting it requires local access or control over the NFC device. The vulnerability is not listed in the CISA KEV catalog.