The Linux kernel’s perf subsystem accepts an ACR mask from user space without fully validating the mask. This flaw is classified as a CWE-184 vulnerability, which involves incorrect modification of a resource that already holds a valid value. The vulnerability allows an attacker to supply a malformed mask that contains bits belonging to other ACR event groups. The kernel previously returned early on detection of such invalid bits, which caused all subsequent ACR groups to be skipped. Additionally, the stale hardware mask was not cleared before writing a new configuration, potentially leaving legacy settings in place. These issues could lead to incorrect or missing performance counter data, disrupt workload monitoring, or in the worst case cause kernel failures or denial of service. The patch drops unsupported bits, continues processing remaining groups, and clears stale hardware masks, preventing the problematic behavior.

Hosts running the Linux kernel are affected. The advisory does not list specific kernel versions; any deployment using the current kernel configuration without the fix is vulnerable.

The CVSS score of 5.5 places this vulnerability at moderate severity. The EPSS score of less than 1% indicates a very low probability of exploitation. The vulnerability is listed as not in the CISA KEV catalog. Based on the description, it is inferred that the likely attack vector is local; a user with permission to invoke perf_event_open can supply an invalid ACR mask, invoking the flaw. No privilege escalation or remote exploitation is required or documented. Given the low exploitation probability and moderate impact, the risk is considered low to moderate for most environments.