In the Linux kernel, the function em_text_dump() allocates a structure on the stack without performing any zero‑initialisation. The function then copies only part of the structure into a temporary buffer using strscpy(), leaving the remainder of the structure uninitialised. When nla_put_nohdr() copies the entire structure to a netlink response, the uninitialised bytes are sent to user space. This can expose arbitrary, unpredictable data that was present on the stack, potentially revealing sensitive information such as cryptographic keys, passwords, or other secrets. The vulnerability provides a direct information‑disclosure flaw without any capability to execute code or elevate privileges.

All Linux kernel builds that include the net/sched code before the zero‑initialisation change are affected. The fix was applied in commit b04202d6065c, which replaced strncpy with strscpy and added zero‑initialisation to struct tcf_em_text. Therefore, any Linux kernel version prior to that commit, regardless of distribution, is vulnerable. Distributions that ship kernels older than the mentioned commit without applying the upstream patch must update their kernel.

The CVSS score of 3.3 indicates low severity, and the EPSS score is reported as less than 1%, suggesting a very low probability of exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the information leak can be triggered by a local user who executes the ‘tc filter show’ command or performs a raw RTM_GETTFILTER dump via netlink. Such commands typically require CAP_NET_ADMIN privileges. Thus, the attack vector is likely local privileged access rather than remote exploitation, limiting the overall risk to users with kernel‑level privileges.