An internal pointer collision in the Linux kernel’s tracing subsystem causes the reference counter of a dynamic event to be misinterpreted as a module pointer. When the kernel code handling the set_event filter reads this corrupted value without verifying the dynamic flag, it dereferences the small integer as a module structure, triggering a NULL or invalid pointer dereference. This leads to a kernel oops and brings the entire system down, effectively denying service. The flaw aligns with CWE-843 (type confusion). Based on the description, the vulnerability is exercised when a user manipulates the set_event interface for a module name while a dynamic tracing event has an active reference count.

Any Linux kernel build that includes the tracing subsystem with the struct trace_event_call layout described is vulnerable, encompassing all releases prior to the commit that added the dynamic flag check. The affected vendor is Linux, and the product scope covers all kernel versions up to the one in which the fix was merged. Precise version ranges are not enumerated in the available data.

With a CVSS score of 4.4 and an EPSS score below 1 %, the overall risk is moderate and the likelihood of exploitation is very low. The vulnerability is not listed in the CISA KEV catalog, indicating no public exploits have been identified to date. It is inferred that an attacker would need local access that allows creation or modification of dynamic tracing events and the ability to invoke the set_event filter; such capabilities typically require root or kernel debugging privileges. Once triggered, the kernel crash will require a reboot, resulting in temporary loss of availability for the affected host.