In the Linux kernel, the following vulnerability has been resolved:

perf: Require kernel access for text poke events

Perf events with exclude kernel=1 can be opened without kernel perf access. However, exclude kernel does not suppress text-poke sideband records. Every PERF RECORD TEXT POKE is marked PERF RECORD MISC KERNEL and contains a raw kernel instruction address.

An unprivileged task can therefore open and mmap a task-local software event with text poke=1. Both opening a count-only tracepoint event and configuring UDP GRO for ESP-in-UDP cause updates to inline static calls; the observer receives the relocated addresses of the modified instructions. For a known kernel image, any such address reveals the runtime kernel text base despite KASLR.

Call perf allow kernel() whenever attr.text poke is set, regardless of exclude kernel. Events that neither monitor kernel execution nor request text-poke records retain their existing permissions.