The register_pid() routine in the Linux kernel’s perf scheduling subsystem processes untrusted perf.data files and exposes several critical defects. An integer overflow arises when computing the buffer size for task descriptors on 32‑bit systems, leading to a tiny reallocated buffer that is overwritten during initialization. A second flaw copies the task name into a fixed 20‑byte buffer via strcpy without bounds checking, creating a heap buffer overflow. Additionally, the code uses BUG_ON on allocation failures, causing kernel panics, and leaks the previous pointer on realloc failures, corrupting internal state. These defects can corrupt kernel memory and allow an attacker to inject code or crash the system, resulting in privilege escalation or denial of service.

All Linux kernel builds that have not incorporated the commit series in the referenced links (5949d339f5ec98752d56dcd4e36f619a59d513a5, 5ea1dcc9418c4e06ce29ed5170596f497ba86872, 652cea73b7b7b7c622a2be670e44e3c499c6d49f) are vulnerable. The kernel component affected is the perf scheduling subsystem; no specific patch level numbers are listed, so any pre‑patch kernel is at risk.

The CVSS score of 9.3 signals an extremely high severity. The EPSS score is less than 1%, indicating a very low probability of exploitation at this time. The vulnerability is not listed in CISA KEV, so there is no confirmation of active exploitation. The likely attack vector involves a local or remote attacker providing crafted perf.data files to the system or compromising the tools that generate such data. If exploited, an attacker could trigger out‑of‑bounds writes or kernel panics, leading to either denial of service or privilege escalation.