The Linux kernel perf subsystem has a flaw that allows an unprivileged user to collect kernel callchain information by calling perf_event_open with attr.exclude_callchain_kernel set to 0 while attr.exclude_kernel remains 1. Because the existing permission check perf_allow_kernel is applied only when attr.exclude_kernel is false, the second check is bypassed, permitting retrieval of kernel stack traces without the necessary kernel profiling privilege. This represents improper access control, classified as CWE-497, and can expose kernel memory contents and internal state.

All publicly available releases of the Linux kernel that include the perf_event_open implementation are affected. The vendor list indicates it applies to any environment running the Linux kernel; no specific version qualifiers are provided, so all current kernel releases containing this code path are potentially impacted until the fix is deployed.

The CVSS score of 3.3 and an EPSS score of less than 1% indicate a low severity and a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need local access to invoke perf_event_open; the flaw does not require elevated privileges. Once a user can open the event, they can obtain kernel callchains, which could aid in further analysis of the system. Despite the potential for information disclosure, the overall risk is considered low for most environments due to the low severity metrics and the local‑execution requirement.