The Linux kernel’s performance monitoring subsystem for RISC‑V contains a bug where the available‑counter mask was stored as a single unsigned long, but the code later iterates over a 64‑bit bitmap. On 32‑bit RISC‑V processors this causes the kernel to read and write past the allocated memory. The out‑of‑bounds read/write can expose kernel memory contents, potentially leaking confidential data, or corrupt internal structures, leading to system instability or crashes. The vulnerability is a classic out‑of‑bounds read/write flaw (CWE‑125). The likely attack vector is the perf interface on affected 32‑bit RISC‑V kernels, where a malicious user could supply crafted performance event parameters to trigger the counter mask overflow. Based on the description, it is inferred that an attacker would need local or privileged access to submit such events.

All 32‑bit RISC‑V builds of the Linux kernel that enable CONFIG_RISCV_PERF and run the perf interface, including any kernel version prior to the commits referenced. No specific version numbers are listed, so all kernels lacking the fix are considered affected.

The EPSS score is less than 1%, indicating a very low exploitation probability. The CVSS score of 5.5 indicates moderate severity. The vulnerability is not listed in the CISA KEV catalog, suggesting no widely known exploits. However, the defect exists in kernel space, so an attacker with local or privileged access to the perf interface can trigger the out‑of‑bounds read/write. The likely attack vector is through the perf interface on 32‑bit RISC‑V kernels, where an attacker can supply crafted performance event parameters to cause the counter mask overflow. The potential for kernel data leakage or a crash suggests a moderate to high risk for compromised or locally privileged users.