The vulnerability allows an unprivileged process to open and mmap a performance event with text_poke enabled while setting exclude_kernel=1. The resulting PERF_RECORD_TEXT_POKE records are marked as kernel events and contain the raw address of relocated kernel instructions. An observer of these records can thus obtain concrete kernel instruction addresses, revealing the runtime base address of the kernel image, even when KASLR is active. The disclosure of this address can be a stepping stone for further kernel exploitation, including privilege escalation or code execution in the kernel space.

All systems running the Linux kernel, regardless of vendor, are affected. No specific kernel releases are listed, so any kernel that still implements the unprotected text‑poke behavior is vulnerable. The issue originates from the generic Linux kernel source and therefore applies across all mainstream distributions.

EPSS data is not available and the vulnerability is not listed in CISA’s KEV catalog, but the weakness is significant due to the kernel address exposure. The attack vector requires the ability to create a perf event, a capability normally available to any process. Once the kernel base address is known, an attacker could build or trigger more complex exploits against the kernel. The CVSS score is not provided, so assess the risk conservatively, assuming a high potential severity given the kernel information leakage.