The kernel’s ADIS16136 gyro driver exposes a serial_number file through the debugfs interface. The file operations for this entry are open coded and never invoke debugfs_file_get(), meaning the debugfs_create_file_unsafe() routine used to create the file does not guard against a read being in progress when the device is unbound. As a result, if an attacker can read the serial_number debugfs file, the device’s serial number would be disclosed. The CVE description does not specify the permission level required to access this file, so it is unclear whether an arbitrary local user can read it; this limitation is an inferred assumption.

Affected systems are Linux kernel distributions that incorporate the ADIS16136 iio driver. Vendor identifiers are "Linux:Linux," indicating generic kernel builds. Specific kernel release versions are not listed, so any kernel containing the unprotected serial_number debugfs entry may be impacted.

The CVSS score of 4.1 indicates a low‑to‑moderate impact on confidentiality. The EPSS score is <1%, implying a very low probability of exploitation. It is not listed in the CISA KEV catalog. The likely attack vector is local and requires read access to the debugfs entry. If the serial_number file can be read by non‑privileged users, an attacker could obtain the device serial number; however, the CVE description does not confirm that unprivileged access is granted, so this is an inferred assumption.