The Linux kernel’s tracing subsystem contains a NULL pointer dereference in func_set_flag(). The function accesses tr->current_trace_flags without first verifying that the active tracer is the function tracer. When the tracer has been switched to another type, tr->current_trace_flags can be NULL, causing a NULL pointer dereference and a kernel panic. The resulting kernel crash constitutes a denial of service condition.

All Linux kernel builds that include the affected tracing code and do not incorporate the patch are susceptible. The vendor list indicates the issue spans general Linux distributions, but specific version numbers are not supplied. Any kernel prior to the fix, irrespective of distribution or kernel variant, remains vulnerable.

The CVSS score is 5.5, indicating moderate severity. The EPSS score is less than 1% and the vulnerability is not listed in CISA’s KEV catalog, suggesting a low probability of widespread exploitation. Nevertheless, the flaw is locally exploitable: a process with write access to the tracing options files (for example, func_stack_trace) can trigger the crash by first switching the tracer away from function tracing and then writing to the option file. The attack requires only local file‑system access and does not demand additional privilege escalation. The impact is immediate kernel panic and loss of service for the local system.