The flaw allows an event that has been marked EXIT during an exec to be accepted as a group leader by perf_event_open. A new sibling can then be linked to the detached leader, and when the original leader is closed the kernel mistakenly believes it has been detached. The new sibling retains a dangling group_leader pointer to a freed event. If an attacker can trigger this sequence, they can cause a use‑after‑free that may be exploited to corrupt kernel memory or gain elevated privileges. The vulnerability does not affect user‑mode processes directly but can be used by a local attacker who can create perf events and has the ability to close the original event.

All Linux kernel releases that have not yet incorporated the patch. No specific version list was provided, so all kernels prior to the fix are potentially vulnerable.

No CVSS or EPSS score is currently published, and the vulnerability is not listed in CISA’s KEV catalog. Nevertheless, the mechanics of the bug (a use‑after‑free inside the kernel’s perf subsystem) imply a high potential for a privileged local exploit. Real‑world impact would likely be kernel crash, data corruption, or arbitrary code execution, depending on what is overwritten by the attacker. The attack requires local execution privileges sufficient to create perf events, but does not require root privilege, so non‑privileged users can potentially trigger the flaw if the system’s perf settings allow it.