The Linux kernel perf subsystem had a bug where detaching a sibling event in a group could leave the group's leader pointer pointing to memory that had already been freed. When an ioctl dereferences that stale pointer, the kernel attempts to read the invalid address, causing a crash. The reported failure stack shows a kernel paging request at an invalid address, indicating a kernel fault. The description does not explicitly state that arbitrary code execution can be achieved; it only demonstrates a kernel crash.

The flaw was present in all Linux kernel releases that implement the perf framework before the fix was applied. Since the advisory does not enumerate specific affected versions, any distribution shipping an unpatched kernel that supports CPU hot‑plug and perf events is potentially vulnerable, especially kernels in the 6.x series where the crash example was reproduced.

The exploit requires specific kernel conditions—detaching a sibling while the group leader is later freed in a hot‑plug scenario. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, so publicly documented exploitation is lacking. The CVSS score is unspecified, making the exact severity uncertain. A local or privileged user who can create perf event groups and trigger CPU hot‑plug operations could potentially crash the kernel or use the use‑after‑free as an additional foothold if downstream vulnerabilities exist.