CVE-2026-64402

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The vulnerable path is reached locally through perf_event_open(), AUX-buffer mmap, and perf event scheduling or ioctls; it has no network or physical entry point.

AC:LAttack complexity, low

An attacker can choose a small AUX buffer, advance aux_tail, and repeatedly stop and restart their own trace until the monotonically increasing head crosses the buffer size. No race or condition outside the attacker's control is required.

PR:LPrivileges required, low

A self-targeted event with exclude_kernel=1 is available to an ordinary unprivileged user under the mainline default perf_event_paranoid setting, and selecting the SMB sink requires no privileged sysfs write.

UI:NUser interaction, none

The attacker creates, runs, consumes, and stops their own tracing event without any victim action.

S:UScope, unchanged

Exploitation compromises the host kernel within the same security authority and does not inherently cross a VM, IOMMU, or other separate security boundary.

C:HConfidentiality impact, high

The out-of-range page-pointer lookup directs memcpy() through a pointer obtained from groomable adjacent kernel memory. Resulting kernel-memory corruption can plausibly enable control-flow hijacking and unrestricted disclosure.

I:HIntegrity impact, high

The attacker-influenced trace data is written through an invalid kernel pointer, providing exploitable memory corruption that can plausibly yield arbitrary kernel modification or code execution.

A:HAvailability impact, high

An ungroomed invalid destination pointer can immediately cause a kernel oops or panic, and the attacker can trigger the path repeatedly.