A union collision in the Linux kernel’s tracing subsystem allows a dynamic event’s reference counter to be misinterpreted as a module pointer. When a file system or kernel call filters events by module name, the code mistakenly treats the small integer reference count as a valid module struct, causing an invalid pointer dereference and resulting in a kernel Oops. This bug can lead to a loss of system availability as the kernel crashes and requires a reboot.

The vulnerability affects any Linux kernel version in which the struct trace_event_call implementation merges the module pointer and the refcnt atomic variable without guarding the dynamic event flag. All affected releases prior to the commit that introduced the fix are potentially impacted; specific version ranges are not provided in the available data.

The attack requires the ability to trigger a dynamic event such as a kprobe, uprobe, or similar, and then manipulate the tracing set_event interface to target a module name. The likelihood of exploitation is uncertain due to missing EPSS data, and the vulnerability is not listed in the CISA KEV catalog. The primary risk is a local kernel crash, which may be leveraged by a privileged attacker to disrupt services. Remote exploitation is unlikely without additional privilege escalation or kernel debugging access.