This vulnerability arises in the Linux kernel TIPC networking subsystem. The unnecessary strcpy call copies the interface name into a fixed‑size buffer without ensuring the remaining padding bytes are set to zero. The previously left‑over data from the original socket buffer was transmitted to remote peers in RESET/ACTIVATE messages, allowing sensitive kernel data to leak over the network. The weakness is a classic case of information exposure from uninitialized memory.

All Linux kernel installations that have not yet applied the fix, regardless of distribution, are potentially affected. No specific kernel version range was supplied in the advisory, so assume any kernel generation before the patch may be vulnerable.

The vulnerability has a CVSS score of 5.3, indicating a moderate severity. The EPSS score is reported as < 1%, implying a low probability of exploitation. It is not listed in the CISA KEV catalogue. The attack vector is inferred to be local; the bug only manifests when the kernel sends RESET/ACTIVATE messages, which generally requires kernel‑level privilege or an attacker that can inject code into the kernel. Consequently the likelihood of exploitation is low for a remote attacker but higher if local privilege escalation can be achieved.