A null pointer dereference occurs in the Linux PowerPC kernel when the current process’s memory context is released while the kernel attempts to capture a user call chain for profiling, leading to a kernel panic. The crash stops the affected system and can be triggered by running certain profiling BPF programs. The failure is a local denial‑of‑service; it does not directly expose data but crashes the system, potentially causing service outages. The likely attack vector is local, inferred from the need to execute a profiling BPF program.

All Linux kernel builds that include the PowerPC perf_callchain_user logic are affected. No specific version numbers are listed, but any kernel that has incorporated the recent perf changes without the added NULL check is vulnerable.

The CVSS score is 7.0 and the EPSS score is unavailable. The description indicates that the crash occurs during profiling BPF program execution, so it is inferred that the attack requires local execution privileges or the ability to load such programs. This could involve CAP_PERFMON or CAP_SYS_ADMIN permissions, but the exact required privilege set is not explicitly stated in the CVE data. The vulnerability is not listed in the CISA KEV catalog, indicating no known exploits at the time of analysis.