The Linux kernel contains a fault in the of_alias_scan() stem parser that performs an out‑of‑bounds read one byte before the property name when the name is empty or consists solely of digits. This misread can expose kernel memory contents, resulting in information disclosure. While the flaw alone does not grant code execution, the leaked data could potentially be leveraged by an attacker who has local privileged access to achieve further compromise. The weakness aligns with CWE‑125.

This defect is present in all kernel versions released before the commit that introduces the fix, which is tracked in the Linux kernel’s stable branch. All Linux distributions that ship the kernel unchanged are affected, including mainstream distributions such as Ubuntu, Debian, CentOS, and Red Hat Enterprise Linux. The patch is available in the latest upstream releases and can be applied via a kernel update sequence supplied by the respective distribution.

The EPSS score is below 1%, and the vulnerability is not listed in the CISA KEV catalog, indicating limited publicly documented exploitation. The flaw requires kernel‑mode execution to be triggered, implying that the attack vector is local. Given the low exploitation probability and the need for privileged kernel code, the overall risk is moderate, but in environments where an attacker can gain local access, the confidential information leakage remains a notable concern.