A flaw in the Linux kernel’s kprobe handling causes a crash when a module is removed or loaded after the ftrace subsystem has been disabled. The core issue is that the kprobe module does not honor the ftrace‑disabled flag, resulting in a null pointer dereference (CWE-476). This invalid memory access occurs during a module unload and triggers a kernel panic that nullifies system availability, which can be triggered by a local user with permission to load or unload kernel modules.

All Linux kernel versions that have not incorporated the recent fix. No specific version range is enumerated, so any kernel using the standard kprobe/kprobes module is potentially vulnerable until patched.

The EPSS score of < 1% indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 5.5 places it at moderate severity. The flaw is a null pointer dereference (CWE-476) that does not provide a direct code‑execution vector. However, it allows a local attacker with privilege to modify kernel modules to trigger a kernel crash, disrupting service. The risk is therefore high for systems where modules can be manipulated without additional isolation controls, but exploitation remains limited to privileged contexts.