When CONFIG_CALL_DEPTH_TRACKING is enabled on an x86 CPU that has retbleed mitigations, registering a dynamic ftrace trampoline causes the kernel to mis‑relocate a %rip‑relative instruction that increments the per‑CPU call depth counter. Because the relocation uses a static offset instead of one adjusted at runtime, the instruction references an invalid memory location, triggering a page fault and a kernel panic. The crash halts pod kernel execution, resulting in a denial of service to the entire system.

Vulnerable systems run the Linux kernel with the original ftrace relocation logic and with CONFIG_CALL_DEPTH_TRACKING enabled. The defect arises after the commit that introduced %rip‑relative addressing for PER_CPU_VAR() (59bec00ace28) and applies to kernels such as 7.0.10 #243 and the 7.1 releases up through rc5, as well as any derivative builds that have not incorporated the subsequent patch fixing the relocation.

The EPSS score is below 1 % and the issue is not listed in CISA’s KEV catalog, indicating a low probability of exploitation. The likely attack vector is a privileged user who can enable dynamic ftrace trampolines via the /sys/kernel/tracing interface; local root or administrative privileges are required. Based on the description, this privilege requirement is inferred. Once triggered, the system experiences an immediate kernel panic, but remote exploitation is improbable and the impact is confined to the local system where the configuration is present.