A high-severity use-after-free vulnerability exists in the Linux kernel perf subsystem, which could allow a local authenticated attacker to achieve privilege escalation or system instability.

The vulnerability is a use-after-free flaw located in the perf_group_detach function. It occurs when a sibling event is detached but kept alive, leading to a situation where a subsequent ioctl dereferences a previously freed group leader pointer, requiring local low-privileged access.

Successful exploitation of this vulnerability allows a local attacker to execute arbitrary code with kernel-level privileges. Given the CVSS score of 7.8, this poses a significant risk to system integrity and confidentiality, as it enables full compromise of the affected host. Organizations running multi-tenant environments or systems with untrusted local users are at the highest risk.

Immediate Action: Update the Linux kernel to version 5.10.267, 5.15.218, 6.1.185, 6.6.154, or later, as provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for kernel oops or segmentation fault patterns related to perf events, which may indicate attempted exploitation.

Compensating Controls: Restrict access to the perf subsystem by limiting the perf_event_paranoid sysctl value to 3, which disables performance counters for unprivileged users.

Public Exploit Available: Unknown

This vulnerability represents a significant security flaw within the core Linux kernel. System administrators should prioritize testing and deploying the necessary kernel patches to all production environments. Given the potential for local privilege escalation, mitigating this risk is essential for maintaining the security boundary between local users and the kernel.