The Linux kernel’s tracing subsystem contains a flaw in the helper function hist_field_name(). When a fully‑qualified variable reference is truncated by snprintf(), the function returns a NULL pointer, bypassing the normal guard that transforms a NULL output into an empty string. Callers such as trace_events_hist.c and the event‑sorting logic then dereference this pointer without checking for NULL, causing a kernel panic. This null pointer dereference is identified as CWE‑476 and can lead to a kernel crash, exposing the system to a denial‑of‑service condition.

All Linux kernel implementations that employ the tracing subsystem and invoke hist_field_name() during histogram variable handling are affected, regardless of specific release numbers. Any kernel image that has not incorporated the recent patch to guard against the truncation path remains vulnerable.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog, further supporting its low prevalence. Based on the description, it is inferred that an attacker would need the ability to inject a trace event string with an excessively long variable name or otherwise trigger the truncation path. This would typically require local or privileged access to the kernel’s tracing interface. When successfully triggered, the resulting kernel crash constitutes a denial‑of‑service that could, in turn, facilitate a compromise if the system remains operational in a compromised state.