The vulnerability stems from a null pointer dereference in the Linux kernel’s perf subsystem during the cleanup of active perf events. When a module unload occurs while a perf connection is still open, the event’s pmu pointer is cleared to null and later referenced, triggering a general protection fault and bringing the system down. An attacker controlling or manipulating perf events could therefore cause a kernel panic, leading to loss of availability of the affected system. The flaw is rooted in an unchecked null pointer use.

All Linux kernel releases prior to the application of the commits referenced in the advisory (c/7fa9a465ae8f07c0e4685db6b6a6f984dbd784 and c/88aed0422f39b22406f35f1e758cea25e7bbcfb5) are affected. The issue exists across all architectures where the perf event handling code is compiled and has not yet been patched. No specific kernel version numbers are listed, so administrators should verify that their current kernel incorporates the fixes from the cited commits.

Based on the description, the likely attack vector is local: a local actor with permission to create and unload perf events can trigger a general protection fault that brings the system down. The EPSS score is < 1%, indicating a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog, suggesting no known public exploitation. The risk remains serious when perf events are enabled, but the low exploitation probability and lack of remote vectors reduce the overall threat level. The CVSS score of 5.5 indicates moderate severity.