The flaw in the Linux kernel’s perf subsystem permits an unprivileged user to request kernel callchain data by calling perf_event_open with attr.exclude_callchain_kernel set to 0 while attr.exclude_kernel remains 1. Because the kernel does not enforce the perf_allow_kernel check for this request, the caller gains access to kernel stack traces. This unauthorized access could expose sensitive kernel memory contents, internals, or reveal vulnerabilities that can be leveraged for privilege escalation.

The issue affects the Linux kernel across all versions for which the specific code path exists. Vendors listed include Linux:Linux. No version qualifiers are supplied, so all current releases are potentially impacted until the fix is applied.

The CVSS score is not available, and the EPSS is not disclosed; the vulnerability is not currently in the CISA KEV catalog. Attackers would need local access to open a perf event; if they can do so, they can obtain kernel callchains without the required kernel profiling privilege. The lack of a required privilege check, coupled with the ability to read kernel stack traces, makes it a serious information‑disclosure and potential privilege‑escalation vector. During risk assessment, consider the likelihood of local exploitation and the sensitivity of the data that could be exposed.