iio_push_to_buffers_with_ts_unaligned() is a kernel function that, when supplied with data whose length is not a multiple of eight bytes and when timestamping is enabled, copies a bounce buffer that has not been zeroed into userspace. The uninitialized memory in the buffer can contain leftover kernel data or sensitive user information, allowing an attacker to read arbitrary kernel memory that was never initialized. The weakness is a classic information‑exposure flaw categorized as CWE‑908.

The vulnerability exists in all Linux kernel releases that include the IIO subsystem without the announced patch. The advisory does not constrain the fix to a particular kernel version range, so every actively maintained kernel that has not applied the kernel commit “iio: buffer: Ensure bounce buffer used for unaligned case is zeroed” is potentially affected.

The exploit probability, as measured by EPSS, falls below 1 % and the vulnerability is not listed in the CISA KEV catalog, indicating a very low chance of attack. The CVSS score of 3.3 reflects a low severity. The likely attack vector involves a local user‑space process that interacts with an IIO device driver and invokes iio_push_to_buffers_with_ts_unaligned with unaligned data while timestamps are enabled; this inference is based on the description of the memory copy path rather than an explicit statement in the advisory.