The vulnerability is a reentrancy flaw in the Linux kernel’s PEBS drain function. When drain_pebs() is reentered, stale buffer state can cause the kernel to read or write memory outside the bounds of the PEBS buffer. This can corrupt kernel data, trigger a crash, or potentially expose kernel memory contents to user space, which could be leveraged for information disclosure or arbitrary code execution.

Affected systems are all Linux kernel builds that support Intel PEBS on x86 CPUs. The flaw was introduced in the generic perf/x86 Intel PMU code and is present in any kernel version that has not applied the fix found in the commit referenced in the advisory. No specific version list was released, so any kernel earlier than the patch is vulnerable.

The risk is high because the flaw can be triggered from running applications that enable PEBS or generate PMI events. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, but the impact of an out‑of‑bounds access in the kernel gives it potential severity. Exploitation would require the attacker to induce a concurrent PEBS drain while a PMI event occurs, which is technically complex but not impossible on systems with active PMU usage. Administrators should treat this as a high‑priority patch issue.