In the Linux kernel, an out‑of‑bounds read occurs when the em_text match algorithm name is supplied without a terminating NUL byte. The kernel copies the 16‑byte algorithm string into a structure, then passes it to a helper function that interprets the string as a module name. Because the string has no NUL terminator, the function reads past the array boundary, consumes adjacent memory, and produces an untrusted module name. The kernel then attempts to load a module powered that name, leaking kernel memory contents to user space, providing a kernel data disclosure. A local administrator with CAP_NET_ADMIN privileges on a network namespace can trigger the flaw by installing the clsact qdisc, adding a filter with a text ematch where the algo string contains no NUL byte, and setting a pattern length. The kernel will refuse to add the filter, emit an ENOENT error, and invoke the module loader with a malformed module name, causing the memory read. The vulnerability triggers only after specific privileged operations; it is not a remote code execution flaw. However, it provides an attacker with kernel memory which could be leveraged for further attacks or information gathering. No public exploit has been reported, but the EPSS score is around 0.00168 (<1%), and the lack of a hard KEV flag does not diminish the potential impact for systems that remain unpatched.

The flaw resides in the Linux kernel’s traffic‑control subsystem (net/sched). All Linux kernel releases before the patch that added a NUL‑terminator check in the em_text handling are affected; the CVE data does not specify an explicit version range.

The CVSS score is 3.3, the EPSS score is around 0.00168 (<1%), and the flaw is not listed in the CISA KEV catalog. The vulnerability can be exploited by an attacker with CAP_NET_ADMIN privileges on a local or namespace‑isolated system. An attacker crafts a netlink attribute that supplies a 16‑byte em_text algorithm name without a NUL byte, causing an out‑of‑bounds read and a kernel memory disclosure. Because the attack requires privileged policy changes, remote exploitation is unlikely, but on a compromised or misconfigured host the disclosure could be a stepping‑stone for further compromise.