A flaw was found in the Linux Kernel. The tlsistxready() incorrectly checks for list emptiness, potentially accessing a type confused entry to the listhead, leaking the last byte of the confused field that overlaps with rec->tx_ready.
{ "urgency": "not yet assigned" }