The kernel tracing ring‑buffer implementation fails to verify the length field before using it to compute a pointer into the ring buffer. This flaw can cause an out‑of‑bounds memory access when an event contains a malformed length, potentially leading to kernel memory corruption or system crash. Based on the description, a malicious input could trigger this behavior.

All Linux kernel releases that include the vulnerable tracing implementation before the commit that introduces the length‑check are affected. The issue applies to the default tracing and ftrace subsystems across all major distributions.

The CVSS score of 5.5 indicates medium severity, while the EPSS score of <1% reflects a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog, implying no known live exploits. The flaw is local and requires an ability to influence kernel tracing, such as providing crafted events to the tracing subsystem. Inferred that exploitation would involve supplying an event with an invalid length to trigger the out‑of‑bounds access.