A high-severity vulnerability in the Linux kernel allows local users to trigger system instability or denial of service due to improper handling of performance event groups.

This vulnerability occurs within the perf/core component, where improper detachment of event groups during the remove_on_exec process leads to state inconsistencies. An authenticated local attacker with low privileges can exploit this to corrupt the PMU context active list, resulting in system instability or a potential denial of service.

The vulnerability carries a CVSS score of 7.8, indicating a high risk level. While exploitation requires local access, the potential for system instability or a denial of service can disrupt critical business operations, particularly on multi-user systems or shared infrastructure. Successful exploitation may lead to unexpected kernel panics or service unavailability, necessitating urgent attention for environments where uptime is critical.

Immediate Action: Update your Linux kernel to the versions containing the upstream fix, specifically 6.6.145, 6.12.96, 6.18.39, or 7.1.4.

Proactive Monitoring: Monitor system logs for kernel-related errors, specifically messages related to performance monitoring unit (PMU) or perf event failures, which may indicate attempted exploitation.

Compensating Controls: Restrict access to performance monitoring interfaces or limit the ability of low-privileged users to execute performance profiling tools, which can serve as a temporary mitigation until the kernel is patched.

Public Exploit Available: No

Given the high severity of this kernel-level vulnerability, administrators should prioritize patching as part of their standard maintenance cycle. While exploitation requires local access, the potential for system-wide impact makes it essential to apply the provided kernel updates to ensure stability and prevent potential denial of service attacks.