The flaw occurs in the Linux kernel's ARP ioctl handling. A user can provide a struct arpreq with an IFNAMSIZ‑sized device name that is not NUL terminated. When the kernel attempts to look up the network device, it copies this string and compares it with existing interface names using strcmp(). If a matching name exists, strcmp() reads past the allocated buffer, creating an out-of-bounds read. The read may expose kernel memory to an attacker, potentially leaking sensitive data. No potential for direct execution or denial of service is described, but the data leakage itself is a significant confidentiality risk.

The vulnerability affects the Linux kernel implementations referenced by the CVE. All Linux kernel versions that contain the unguarded arp ioctl code are susceptible until the upstream patch that inserts a string termination before lookup is applied. Impacted platforms include any distribution that ships the affected kernel without the fix, regardless of vendor. Specific versions are not enumerated in the CVE, so any kernel prior to the commit that introduced the fix is presumed vulnerable.

Because the vulnerable code path requires invoking the ARP ioctl with a crafted struct, the attack surface is local to a process that can perform this ioctl, typically requiring CAP_NET_ADMIN or root privileges. The likely vector is a local privilege escalator or a process already privileged. The EPSS score is < 1%, and there is no KEV listing. The CVSS score is 5.5, indicating moderate severity but still a notable confidentiality impact from an out-of-bounds read. An attacker may use the read to dump kernel memory or glean network device information. The vulnerability is not publicly exploited according to KEV, but its presence in the kernel warrants prompt attention.