The Linux kernel contains a flaw where the structure that holds branch event data contains two fields, new_type and priv, that are never initialised for a subset of records. When these values remain unset, the kernel exports the stale or uninitialised content of the structure to userspace through the perf subsystem. This can allow observers of perf data to read arbitrary kernel memory fragments that were previously stored in the slot, effectively leaking sensitive information. The weakness is a classic case of use of uninitialised variables, corresponding to CWE-457.

All Linux kernel builds that include the perf core code before the recent commit that removes perf_clear_branch_entry_bitfields and replaces it with a full assignment. The advisory does not list specific kernel release numbers, but the issue affects configurations where branch event tracing is enabled, notably on arm64 architectures. Any distribution package that supplies an unpatched Linux image is potentially vulnerable.

The vulnerability does not appear in the CISA KEV catalog, indicating that no large‑scale exploitation campaigns have been observed. Based on the description, it is inferred that a local user who initiates a perf trace that includes branch events can trigger the flaw; the attacker can then extract the uninitialised data simply by reading the perf event buffer. Because the flaw is purely a data‑exposure issue without privilege escalation or denial of service impact, overall risk is moderate but the confidentiality compromise can be significant. The lack of a publicly disclosed exploit suggests low probability, yet patching remains prudent.