The Linux kernel tracing subsystem allowed an attacker to craft a filter expression that ends with an unfinished logical operator such as "||" or "&&". The parsing routine did not correctly reject these incomplete expressions, resulting in the parser accessing data outside the bounds of the filter program array. This out‑of‑bounds access could leak memory contents or trigger a kernel panic, effectively destabilizing the system. The weakness is rooted in insufficient input validation during expression parsing.

All Linux kernel builds that implement the perf event filtering code before the fix are affected. Any system that uses perf tracepoints or configures event filters via PERF_EVENT_IOC_SET_FILTER is potentially vulnerable, regardless of distribution or kernel version. The issue is present in the core tracing code paths and applies to all users of the Linux kernel’s perf tracing facilities.

With a CVSS score of 7.8 the vulnerability is considered high severity. The EPSS score is not available, but the lack of a listed KEV disclosure suggests it has not yet been widely exploited in the wild. The likely attack vector is local or requires elevated privileges that allow configuring perf events (e.g., root or CAP_PERFMON). An attacker who can supply a malicious filter expression can trigger an out‑of‑bounds read and potentially crash the kernel, leading to denial of service or information leakage. The warning that content in adjacent slab objects may be exposed highlights the potential for data leakage if the out‑of‑bounds read is consumed by the attacker.