The Linux kernel unit test harness for kprobes registers probes as static variables. After the probes are unregistered, lingering metadata remains in the kprobe structures; when the test is run again, register_kprobe fails and the kernel fault occurs, causing an immediate crash. The failure is triggered by the internal state of the test suite, not by external input, and manifests only when the test is executed a second time.

All Linux kernel releases that ship the kunit kprobes unit tests are affected. This includes mainstream distributions that include the default kernel source tree. No specific version numbers are listed, so any kernel that contains the kprobes_test harness remains vulnerable until the cleanup logic is moved to kprobes_test_init as shown in the patch commit.

The CVSS score of 5.5 indicates moderate severity. EPSS <1% reflects a very low likelihood of exploitation in the wild, and the vulnerability is not present in CISA’s KEV catalog. According to the description, the vulnerability causes the kernel to crash when the kprobes sanity tests are executed more than once. It is inferred that an attacker would need privileged access to write to /sys/kernel/debug/kunit/kprobes_test/run or otherwise trigger the test, thereby achieving a local denial‑of‑service. This inference is not explicitly documented in the CVE details.