The Linux kernel’s perf subsystem contains a flaw in machine__resolve(). The function dereferences env->cpu[al->cpu].socket_id after only checking that al->cpu is non‑negative and that env->cpu is non‑NULL, but it does not verify that al->cpu is less than the number of available CPUs. Because al->cpu originates from a perf.data sample file, an attacker can supply a file with a very large CPU index, causing an out‑of‑bounds heap read of the env->cpu array. Additionally, values like 65536 silently truncate to 0 before the cast to struct perf_cpu, bypassing the accessor’s internal bounds check and returning topology data for CPU 0. This results in an untrusted memory disclosure that could compromise kernel confidentiality.

Linux kernel implementations that pre‑date the merge of commits 5484b43, b9e8406, and eb266a1 are impacted. All distributions that ship the standard perf subsystem with these kernel versions are affected; the exact release numbers are not explicitly listed in the advisory.

Based on the description, it is inferred that the vulnerability requires a local attacker to execute the perf utility with a crafted perf.data file. Also, based on the description, it is inferred that the attack is not remotely exploitable over a network unless privileged capabilities are yielded. The CVSS score of 9.1 indicates high severity, while the EPSS score of < 1% shows a very low probability of exploitation. The vulnerability is not present in CISA’s KEV catalog, however the potential to read arbitrary kernel memory represents a significant local threat, especially in environments where untrusted users can invoke perf or process untrusted data.