The Linux kernel contains a flaw where the struct rtc_wkalrm includes padding after the 'pending' field that is not initialized. When the RTC_WKALRM_RD ioctl returns this structure to userspace, the padding can contain residual kernel‑stack data, allowing privileged code or an attacker with access to the ioctl to read sensitive memory contents, a capability inferred from the ioctl’s handling of the device. The primary impact is the potential disclosure of kernel or user data, which can be used for further exploitation or to compromise confidentiality.

All Linux kernel versions that include the rtc_dev userspace ioctl and have not applied the patch shown in the linked commits are affected. Specific version numbers are not listed, so any kernel build lacking the zero‑initialization change is vulnerable.

The vulnerability relies on the RTC_WKALRM_RD ioctl, which typically requires root or CAP_SYS_TIME privileges—a requirement inferred from the ioctl’s nature and required capabilities. While no exploits are publicly documented and the EPSS score is not available, the existence of the kernel data leak presents a moderate risk for systems where privileged users can abuse the ioctl. The issue is not listed in the CISA KEV catalog, indicating no confirmed field‑deployed attacks yet, but the potential impact warrants prompt remediation.