This vulnerability in the Linux kernel allows a kernel stack leak to user space when the GPIO chip guard cannot be acquired in gpio_desc_to_lineinfo(). The code returns early without zeroing the info structure that will later be provided to user‑space via lineinfo_get_v1(), so stack contents can be exposed. The exposed data may contain sensitive kernel information, such as secret keys or credentials, which constitutes an Information Disclosure weakness (CWE‑908).

All Linux kernel builds that include the vulnerable gpio character device driver before the patch commit are affected. Without specific version range data, any kernel release prior to the integration of the commit that adds the memset fix may be impacted. Administrators should verify the kernel version against the official commit history or update to a kernel where the change has been applied.

The CVSS score is 3.3, and the EPSS score is < 1%, indicating a low probability of exploitation. The description does not explicitly state that a local user can interact with the GPIO subsystem, but based on the code context it is inferred that a local user able to open /dev/gpiochipN and invoke lineinfo_get_v1 with a bad descriptor could trigger the vulnerable path. Such an attacker would receive the uninitialized portion of the info structure, exposing kernel stack data. This does not provide privilege escalation but can leak privileged information; it is not currently listed in the CISA KEV catalog or known as an actively exploited vulnerability.