The vulnerability is in the Linux kernel's perf subsystem for Intel PT. When pt_event_stop() is called without the PERF_EF_UPDATE flag, the routine that should close the auxiliary output context (perf_aux_output_end()) is not executed. A subsequent pt_event_start() then attempts to begin output again, violating the rule that auxiliary output blocks must not be nested. The kernel responds by issuing a warning in perf_aux_output_begin(). This logic defect allows the AUX output buffer to remain in an inconsistent state, potentially skewing collected performance data and creating a residual warning in the system logs.

All Linux kernel builds that include the Intel PT event support are potentially affected, as the flaw arises in the perf/x86/intel/pt code paths that are enabled when group throttling is used. No specific kernel version is cited, so the issue applies to any kernel using this module until the mitigations are applied in newer releases.

The fault only produces a warning and does not provide any remote code execution path; the EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog. The CVSS score is 5.5. Consequently, the risk is considered low. However, exploitation would require a local or privileged process to trigger the problematic sequence of stop/start calls, making the most probable attack vector a local privileged user or system service that utilizes Intel PT with group throttling.