The Linux kernel's scheduler extension previously exposed the CID (CPU ID) tables to readers while they were still being constructed. During a race between the enabling process and the final publish step, a tracing or system‑call program could observe uninitialized entries or partially updated structures in memory. This race condition creates a path to read kernel memory that has never been defined, potentially leaking confidential data. The flaw is an information‐exposure weakness rooted in improper synchronization of read‑copy‑update (RCU) publishing, as described by CWE‑200 and CWE‑788.

The vulnerability affects the canonical Linux kernel across all upstream releases that have not yet incorporated the fix. No specific version list is available, so any kernel build preceding the authors’ patch revision is potentially vulnerable. The flaw surfaces in the sched_ext and cid kfuncs components of the kernel and is triggered when CID tables are built by the root scheduler.

Because the advisory does not supply CVSS, EPSS, or KEV data, the exact severity is unknown; the risk profile is therefore uncertain. As the race requires a process capable of invoking tracing or system calls that access the CID tables, the likely attack surface is an elevated local user or a compromised service with tracing privileges. The advisory labels the issue as a confidentiality concern, but no direct path to code execution is described. In the absence of public exploit evidence or high‑confidence metrics, the vulnerability remains a moderate‑to‑significant risk for affected deployments, especially those that enable tracing or bind to the new CID‑based scheduler.