Linux Kernel EUVD-2026-34134

Exploitation requires simultaneous concurrent access to both CoreSight sysfs tracing (write access to enable_source sysfs attribute) and the perf subsystem's CoreSight sink on the same ARM system with physical TMC-ETR hardware. The attacker must hold at least low-privilege local credentials (CVSS PR:L). High attack complexity (AC:H) reflects the race window dependency - the perf path must win the spinlock between the two sysfs critical sections, which is a timing-dependent condition with no guaranteed reproducibility. Systems without ARM CoreSight hardware, systems where unprivileged users cannot access CoreSight sysfs paths or perf_event_open(), and systems using only a single tracing mode at a time are not exploitable. The 'Information Disclosure' tag in source metadata conflicts with the CVSS C:N vector - no data exposure condition has been confirmed.

CVSS 4.7 with vector AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H accurately reflects a constrained threat profile: local access is mandatory (AV:L), attack complexity is rated high (AC:H) due to the precise timing required to win the race window, and low user privileges suffice (PR:L). Impact is strictly limited to availability - no confidentiality or integrity compromise is possible. EPSS at 0.02% (4th percentile) strongly corroborates this assessment; automated or widespread exploitation is implausible given the hardware specificity and timing dependency. There is no CISA KEV listing and no public proof-of-concept. Despite the 'Information Disclosure' tag appearing in the source data, the CVSS vector (C:N/I:N) and the description confirm no data exposure - this tag appears to be a misclassification. Practical risk is very low and limited to specialized ARM environments where both CoreSight sysfs and perf tracing interfaces are accessible to unprivileged users simultaneously.

A local attacker with low-privileged credentials on an ARM server or embedded system equipped with CoreSight TMC-ETR hardware could write to the CoreSight sysfs enable_source attribute while a concurrent perf session initializes the same ETR sink. If the perf path acquires the spinlock and calls tmc_etr_enable_hw() between the sysfs buffer allocation and hardware enablement steps, the sysfs path subsequently encounters a non-NULL drvdata->etr_buf, firing WARN_ON() and disrupting tracing availability. No public exploit code exists; reliable triggering requires precise scheduling timing on a system with the specific CoreSight hardware.