The vulnerability is a classic use‑after‑free in the Linux kernel’s trace_marker copy mechanism. When the copy_trace_marker option is enabled, data written to /sys/kernel/tracing/trace_marker is copied to an instance’s buffer and the instance’s descriptor is added to a list protected by RCU. During instance deletion, the flag that enables copying is cleared before the list is atomically removed, so the required RCU synchronization is omitted. This allows a reader to access freed memory, potentially corrupting the kernel or providing a foothold for arbitrary code execution. The flaw is consistent with CWE‑416 and CWE‑825, representing a critical kernel memory corruption risk.

The issue appears in any Linux kernel that includes the trace_marker copy feature before the fix; it is vendor‑agnostic and applies to all releases that contain the unpatched implementation. No specific affected versions are listed in the data, so any kernel compiled with the copy_trace_marker option enabled is at risk.

The EPSS score is below 1% and the vulnerability is not listed in CISA’s KEV catalog, indicating low observed exploitation probability to date. However, kernel use‑after‑free bugs typically carry a high impact rating and can be leveraged by an attacker with local privileges to crash the system or execute code with kernel privileges. The CVSS score is 7.8, reflecting a high severity evaluation. Attackers would need to enable or trigger the trace_marker write path while the copy option is active, which generally requires root or CAP_SYS_ADMIN privileges.