The Linux kernel tracing ring‑buffer subsystem fails to validate the length of an event before calculating the offset for the next buffer slot. Without this check, the computed address may reference an unintended memory region, potentially reading or writing beyond the allocated buffer. Such unchecked memory access can corrupt kernel memory, leading to crashes or data corruption. The vulnerability has been fixed by adding a length‑verification guard in rb_read_data_buffer().

All Linux kernel releases that compile the tracing ring‑buffer code and contain the vulnerability, prior to the inclusion of the length‑check fix. This includes the default distribution kernels that have not been updated to the patched version.

No EPSS score is reported and the issue is not listed in the CISA KEV catalog, indicating no widespread active exploitation has been documented. The flaw presents an out‑of‑bounds kernel memory operation that could be exploited by an attacker capable of injecting crafted events into the ring buffer. The attack vector is inferred to be a local or compromised user able to trigger the vulnerable tracing code, potentially causing kernel corruption or intentional denial of service.