This vulnerability arises when the Linux kernel processes untrusted perf.data files. The register_pid() routine suffers an integer overflow when calculating the size required for task descriptors on 32‑bit systems; the overflow causes realloc() to allocate a very small buffer, which is then written to out‑of‑bounds during initialization. A separate issue involves a raw strcpy of the task name into a fixed 20‑byte buffer, potentially overflowing the COMM_LEN buffer when the input string is longer than 19 characters. A BUG_ON triggered on allocation failure can terminate the kernel process, allowing an attacker to crash the system. Finally, a dangerous pointer leak occurs when a failed realloc() leaks the old pointer while the task count is already incremented. Together, these bugs enable an attacker to corrupt kernel memory, potentially leading to arbitrary code execution, privilege escalation, or a denial‑of‑service by crash.

The affected component is the Linux kernel, specifically the perf sched subsystem. All Linux kernel builds before the patch commit applied in the referenced commits (5949d339f5ec98752d56dcd4e36f619a59d513a5, 5ea1dcc9418c4e06ce29ed5170596f497ba86872, 652cea73b7b7b7c622a2be670e44e3c499c6d49f) are potentially vulnerable. No specific version numbers are supplied, so any kernel that has not incorporated these fixes should be considered at risk.

The CVSS score is not disclosed, but the nature of the vulnerabilities—kernel buffer overflows and unchecked realloc failures—indicates a high severity rating. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, so the likelihood of exploitation is uncertain but potentially significant for privileged users who can supply crafted perf.data. The most likely attack vector involves a local or remote attacker with access to the perf subsystem feeding malicious data, although the kernel could also be targeted via compromised tools that generate perf data. In the absence of mitigation, an attacker could trigger out‑of‑bounds writes or kernel crashes, leading to either denial of service or privilege escalation on the affected system.