This vulnerability in the Linux kernel allows a kernel stack leak to user space when the GPIO chip guard cannot be acquired in gpio_desc_to_lineinfo(). The code returns early without zeroing the info structure that will later be provided to user‑space via lineinfo_get_v1(), so the stack contents can be exposed. The exposed data may contain sensitive kernel information, such as secret keys or credentials, which constitutes an Information Disclosure weakness (CWE‑200).

All Linux kernel builds that include the vulnerable gpio character device driver before the patch commit are affected. Since the CPE string identifies the generic Linux kernel (cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*) and no specific version range is given, any kernel release prior to the integration of the commit that adds the memset fix is potentially impacted. Administrators should verify the kernel version against the official commit history or update to a kernel where the change has been applied.

The CVSS score is not listed, and the EPSS score is unavailable, so the inherent severity and probability are not quantified in the public data. The flaw can be exercised by a local user who can interact with the GPIO subsystem, for example by opening /dev/gpiochipN and invoking lineinfo_get_v1 with a bad descriptor. The attacker would then receive the uninitialized portion of the info structure, which contains kernel stack data. This does not provide privilege escalation but can leak privileged information; it is not currently listed in the CISA KEV catalog or known as an actively exploited vulnerability.