The affected Linux kernel driver reads fields from HID reports without first validating that the report contains the expected data. When a short report is received, the driver consumes uninitialized bytes from the HID transport buffer and surfaces them as sensor values through the sysfs interface. This flaw allows an attacker to gain unintended visibility into kernel memory contents, potentially exposing sensitive data and compromising confidentiality. The vulnerability is an example of improper handling of uninitialized data (CWE-908).

The flaw resides in the ASUS ROG Ryujin driver that is part of the Linux kernel. Any Linux installation that includes this driver, regardless of specific kernel version, is potentially impacted. The affected modules reference the Linux:Linux vendor and product family, with no explicit version constraints provided in the CNA data.

Exploitation requires local access to the system or control over the HID device to supply crafted reports, so it is a local threat vector. The EPSS score of <1% and the CVSS score of 5.5 reflect a moderate likelihood of exploitation and moderate severity. The vulnerability is not listed in the CISA KEV catalog, indicating a low likelihood of widespread exploitation. Although the CVSS score indicates moderate impact on confidentiality, the risk remains moderate for systems that expose the raw sensor data via sysfs to untrusted users.