The Linux kernel’s perf subsystem on AMD processors has been found to expose internal kernel memory addresses to user space when the PERF_SAMPLE_BRANCH_USER option is enabled. This occurs because the branch stack can contain branches that originate from kernel space, leading to kernel addresses appearing in user‑space branch samples.

All Linux kernel builds running on AMD processors that support the LBR V2 feature are affected. The issue persists until a kernel update that incorporates the patch enforcing proper filtering of branch‑from addresses for user‑labeled branch samples is applied.

The EPSS score is reported as less than 1%, indicating a very low exploitation probability. The CVSS score of 5.5 indicates moderate severity. The vulnerability is not listed in the CISA KEV catalog. Based on the description, a local user with the ability to run perf commands and enable PERF_SAMPLE_BRANCH_USER can trigger the leakage. The exploit is local and requires only standard user privileges, but the low EPSS suggests automated attacks are unlikely and the primary risk lies with an attacker who can execute code within the host environment.