The vulnerability exists in the Linux kernel’s s390 architecture, specifically in the distribution of per‑CPU data for PMU Performance Accumulation Interface (PAI) events. During a perf stat session when the CPU set changes because a CPU is hot‑added, the code that allocates per‑CPU objects runs only for CPUs that are currently online. The new CPU, which was previously offlined, therefore receives a NULL pointer in the structure that is later accessed. This dereference causes a kernel panic, abruptly killing the operating system and denying service to all running workloads. The vulnerability requires only the ability to run perf and perform hot‑plug actions, typically available to privileged users, and does not provide arbitrary code execution.

Linux kernel instances on s390 platforms that compile with or enable PMU PAI event support are impacted. Any kernel that has not yet incorporated the patch adding hot‑plug handling for per‑CPU data structures is vulnerable. No specific vendor or version list is enumerated in the CNA data, so all s390 kernels before the commit containing the fix are potentially affected.

The CVSS score of 5.5 reflects a moderate severity denial of service, while the EPSS score of <1% indicates a very low probability of public exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation appears to require privileged access to perform CPU hot‑plug operations and to run perf stat. Because the flaw causes a kernel crash rather than privilege escalation or data disclosure, the risk is limited to service disruption rather than broader compromise.