The vulnerability is a reentrancy flaw in the Linux kernel’s PEBS drain function. When drain_pebs() is reentered, stale buffer state can cause the kernel to read or write memory outside the bounds of the PEBS buffer. This can corrupt kernel data, trigger a crash, or potentially expose kernel memory contents to user space, which could be leveraged for information disclosure or arbitrary code execution.

Affected systems are all Linux kernel builds that support Intel PEBS on x86 CPUs. The flaw was introduced in the generic perf/x86 Intel PMU code and is present in any kernel version that has not applied the fix found in the commit referenced in the advisory. No specific version list was released, so any kernel earlier than the patch is vulnerable.

The CVSS score of 5.5 indicates moderate severity. The EPSS score of <1% suggests a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, a reentrancy flaw that can corrupt kernel memory is a significant risk, so the issue should be addressed promptly. Exploitation would still require an attacker to coordinate a PMU event with a concurrent PEBS drain, which may be complex but is feasible on systems running active PMU workloads. Administrators should treat this as a medium‑priority patch issue.