This vulnerability is a race condition that occurs when the __perf_event_overflow() handler runs with only preemption disabled while the perf_event_exit_event() path frees objects that the overflow handler still expects to exist, such as BPF programs. The race can result in the handler dereferencing freed memory, which may lead to kernel memory corruption and a system crash. While the description does not explicitly state privilege escalation, memory corruption could potentially be leveraged by an attacker with sufficient execution control, so the impact may extend beyond denial of service.

All Linux kernel implementations that do not include the patch enforcing IRQ disable in __perf_event_overflow() are affected. This covers every distribution kernel shipped before the commit that introduces the fix, including kernels listed in the provided CPEs (e.g., any kernel prior to 7.0‑rc1 that lacks the update). The flaw exists in systems that have the perf subsystem and BPF support enabled.

The CVSS score of 7.8 categorizes the flaw as high severity, while the EPSS score of less than 1 % indicates a low likelihood of exploitation in the wild. The vulnerability is not tracked in CISA’s KEV catalog. Exploitation would generally require a local attacker who can trigger a perf event overflow and race the cleanup path, implying that privileged or local access is needed to create the conditions necessary for the flaw to be triggered.