The vulnerability allows an unprivileged process to open and mmap a performance event with text_poke enabled while setting exclude_kernel=1. The resulting PERF_RECORD_TEXT_POKE records are marked as kernel events and contain the raw address of relocated kernel instructions. An observer of these records can thus obtain concrete kernel instruction addresses, revealing the runtime base address of the kernel image, even when KASLR is active. The disclosure of this address can be a stepping stone for further kernel exploitation, including privilege escalation or code execution in the kernel space.

All systems running the Linux kernel, regardless of vendor, are affected. No specific kernel releases are listed, so any kernel that still implements the unprotected text‑poke behavior is vulnerable. The issue originates from the generic Linux kernel source and therefore applies across all mainstream distributions.

EPSS score is < 1% and the vulnerability is not listed in CISA’s KEV catalog. The CVSS score of 3.3 indicates a low severity impact, but the kernel address exposure still provides a stepping stone for further exploits. The attack vector requires the ability to create a perf event, a capability normally available to any process. Once the kernel base address is known, an attacker could build or trigger more complex exploits against the kernel.