The flaw is a race condition in the Linux kernel’s perf_mmap implementation. When a mapping of a performance event fails during mmap(), the ring buffer is freed, but a concurrently executing mmap() can still acquire the event’s mutex, observe a valid event->rb pointer, and try to increment its reference count. Because the cleanup path may have already dropped the reference, this race can lead to a use‑after‑free or refcount saturation warning, potentially corrupting kernel memory or crashing the system. According to the description, the condition is identified by a warning in perf_mmap and depends on the ordering of two mmap() calls that access the same event.

All Linux kernel deployments that contain the unpatched perf_mmap code path are affected. The CPE entries indicate that kernel versions up to at least 7.0‑rc1 are vulnerable; any other builds that include the same code base without the patch are also impacted.

The vulnerability has a CVSS score of 7.8, indicating high severity, and an EPSS score of less than 1%, suggesting a low probability of real‑world exploitation. It is not registered in the CISA KEV catalog, further indicating it is not a known actively exploited flaw. Exploitation would require local or privileged access to orchestrate the precise race between a failing and a succeeding mmap() call, making the attack vector local and non‑trivial. If successfully exploited, the impact could be a kernel crash or privilege escalation to the kernel context.