The bug occurs in the Linux kernel’s perf subsystem, where removing a perf event during exec can leave an event group in an inconsistent state. When the group leader event is removed, the kernel does not detach the remaining siblings, so the surviving events stay active with a stale group header. A later close of the removed event may promote those siblings back from the stale group state, and on the next schedule‑in the kernel can add an already linked active list entry again, corrupting the PMU context active list. This corruption causes a kernel fault, resulting in a crash or system instability. The flaw is a classic example of incorrect resource shutdown or release (CWE‑663).

Linux kernel, any build that includes the perf subsystem before the patch that detaches group relationships during remove_on_exec. No specific version numbers are supplied in the advisory, so any current running kernel may be affected.

The CVSS score of 7.8 indicates a high severity of the issue, while the EPSS score of less than 1 % shows a very low likelihood that the vulnerability is actively exploited today. The flaw is not listed in the CISA KEV catalog, so there are no known active exploits. Attackers would need to create perf events that trigger remove_on_exec, which typically requires execution of user processes. With sufficient time and knowledge of the victim’s workload, a local attacker could trigger the corruption and cause a denial of service. Given the low EPSS value, the risk is considered moderate for most environments, but the potential for a kernel crash mandates prompt mitigation.