The flaw resides in the Linux kernel’s perf subsystem, where the addr_filter_ranges data structure is not properly freed under RCU. Because memory allocated for these ranges is never released, an attacker with local user privileges can repeatedly create perf events, leading to gradual exhaustion of kernel memory and eventual denial of service. The weakness is an improper resource release (CWE-772).

The affected product is the Linux kernel whenever the perf subsystem is enabled and the original implementation of addr_filter_ranges is present. Kernels that lack the RCU free change are vulnerable; all kernels that include the patch released in commit 6f1853b2b9f38f1343790bae8c0601b3f7554754 (or equivalent) are not affected.

The CVSS score is 7.8, and the issue is not listed in the CISA KEV catalog, suggesting limited known exploitation. The EPSS score is not available, but the local nature of the vulnerability and the ease with which an attacker can create perf events indicate that exploitation is relatively straightforward on susceptible systems. A local attacker with permission to spawn perf events could trigger the memory leak, eventually forcing the kernel to crash or become unresponsive.