The Linux kernel’s perf subsystem inadvertently exposed kernel memory addresses to user space when the PERF_SAMPLE_BRANCH_USER option was enabled. By capturing branch stack samples, a local user can see kernel addresses, revealing internal layout information that could facilitate subsequent attacks such as privilege escalation or bypassing kernel ASLR. This flaw represents a confidentiality compromise that could aid attackers in exploiting other vulnerabilities.

All Linux kernel builds running on AMD processors that support the LBR V2 feature are affected. The issue is present until a kernel update includes the patch that enforces proper filtering of branch‑from addresses for user‑labeled branch samples.

No CVSS score or EPSS information is available, but the flaw is locally exploitable by any user capable of running perf. The information disclosed may increase the likelihood and effectiveness of further attacks, raising the potential impact to moderate–high. The vulnerability is not listed in the CISA KEV catalog, and the patch has already been incorporated in recent kernel releases.