The vulnerability resides in the Linux kernel's tty subsystem. In vcc_send_ctl the struct vio_vcc pkt is allocated on the stack but only partially initialized. One field, tag.stype_env, remains uninitialized and is subsequently transmitted over an LDC channel by ldc_write. Because the field is not set, it can contain residual data from the kernel stack, allowing an LDC peer to read kernel stack contents and potentially expose sensitive information. The weakness is an improper initialization that leads to information disclosure.

All Linux kernels that contain the tty vcc subsystem are affected; no specific version range is listed, so every release that includes the code may be vulnerable. Vendors are identified as Linux for the Linux kernel.

The EPSS score of < 1% indicates a very low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The CVSS score of 3.3 denotes a low severity issue, but the ability to leak kernel stack data via an LDC channel presents a confidentiality risk that could be exploited by any attacker able to establish a connection with the vulnerable tty subsystem. The absence of publicly available exploits keeps the immediate threat level low until an exploit emerges or a patch is applied.