In Linux, a kernel bug allows a missing address validation when copying user‑supplied syscall buffers in faultable syscalls such as write or pwrite64. The code employs __copy_from_user, which bypasses access_ok, so a non‑user address can be accepted and the faulted entry recorded. This omission can cause kernel faults and system interruption when perf tracing is enabled, potentially leading to denial of service for processes using the affected syscalls.

All Linux kernel builds that predate the latest federally committed fix. Affected vendors are Linux: Linux with no explicit version constraints, so any kernel version without the referenced patch commits is impacted.

Because no CVSS or EPSS score is supplied and the vulnerability is not listed in the CISA KEV catalog, the threat is considered a moderate risk with a low to moderate exploitation probability. Based on the description, it is inferred that an attacker would require the ability to trigger faultable syscalls while having access to enabled perf tracing. Successful exploitation could lead to denial of service by causing kernel faults that disrupt processes.