The vulnerability arises in the Linux kernel's perf tool subsystem where the machine__resolve() function reads the socket_id field of a CPU entry using an index derived directly from untrusted perf.data sample files. The code performs only a basic non‑negative and NULL pointer check but does not validate that the index is less than the number of CPUs available. Because an attacker can supply a perf.data file with a very large CPU index, the kernel will read beyond the bounds of the allocated env->cpu array. This results in an out‑of‑bounds heap read that can expose hidden kernel memory to the attacker, potentially leading to information disclosure or privilege escalation if the leaked data is leveraged in subsequent attacks.

Linux kernel users running versions that pre‑date the merge of commits 5484b43, b9e8406, and eb266a1 are impacted. The exact kernel release numbers are not listed in the advisory, so any installation of the kernel prior to the inclusion of the bounds‑checking fix should be considered vulnerable. The issue affects the perf subsystem that is typically enabled by default on most distributions.

The vulnerability requires local execution of the perf utility against a crafted perf.data file. Since the attack vector is tied to a user‑supplied file, it is not remotely exploitable from external networks unless privileged mechanisms are compromised. No EPSS score is available, and the vulnerability has not entered CISA’s KEV catalog. Nevertheless, the potential to read arbitrary kernel memory represents a high impact local threat, especially in environments where untrusted users can invoke perf or where the kernel is exposed to untrusted data sources.