The Linux kernel mctp i2c driver did not initialize event handler read bytes properly, causing i2c read operations to return uninitialized stack data (a u8 value) on certain platforms such as i2c-aspeed and i2c-npcm7xx. This could lead to unreliable or undefined data being read from the i2c bus. The fix sets the read bytes to 0xff, preventing the use of uninitialized memory during reads. This was verified using the i2ctransfer tool against an mctp-i2c instance.

The vulnerability does not affect confidentiality or integrity but impacts availability by causing unreliable or unpredictable data to be returned during i2c read operations. This could potentially disrupt device communication relying on the mctp i2c interface. There is no indication of privilege escalation or remote code execution. The CVSS vector indicates local attack with low complexity and no user interaction required, resulting in a moderate impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The description indicates the issue has been resolved in the Linux kernel by initializing the event handler read bytes to 0xff. Users should apply the official Linux kernel updates that include this fix once available.