The kernel’s dma_map_sg tracepoint can allocate dynamic arrays large enough to overflow the perf buffer. When devices such as virtio‑gpu create scatter‑gather lists with more than a thousand entries, the tracepoint attempts to record over 20 KB of data, exceeding the 8 KB limit enforced by PERF_MAX_TRACE_SIZE. This results in a buffer overflow logged as a perf buffer warning and can corrupt kernel memory, potentially leading to a system crash or denial of service. This issue is classified as a buffer overflow (CWE‑131).

The vulnerability is present in the Linux kernel across all supported distributions that embed the affected code path. No specific kernel releases are listed in the advisory, so any kernel version that contains the unpatched dma_map_sg tracepoint is susceptible. The focus is on the generic implementation rather than a particular vendor.

Exploitability is considered low to moderate. The EPSS score is below 1 % and the vulnerability is not listed in the CISA KEV catalog, indicating limited public exploitation. Attacks would require access to a user that can trigger large scatter‑gather operations or a privileged context that enables kernel tracing. Because the flaw only manifests when the dma_map_sg tracepoint is active, a local attacker would need to enable tracing and provoke a high‑entry list, making the risk lower than a remote RCE.