The Linux kernel contains a flaw in the tracing subsystem where the module reference counter is decremented immediately after a module with an active tracing enable_event trigger is removed. Although the event trigger is delayed until after the RCU grace period, the module can still be unloaded, allowing the system to read or execute freed memory. This results in a classic use‑after‑free condition that could lead to a kernel panic, data corruption, or malicious code execution if an attacker can trigger the enable_event after the module has been removed.

All Linux kernel installations are potentially affected because the vulnerability exists in the core tracing framework and no specific kernel version range is listed. Any system running a kernel that includes this unpatched tracing code is at risk.

The issue is a race condition and use‑after‑free flaw (CWE‑825) with a CVSS score of 7.8. The EPSS score is listed as <1%, indicating a low probability of exploitation in the wild, and the vulnerability is not currently in CISA’s KEV catalog. Exploitation requires the ability to unload kernel modules and trigger tracing events, typically available only to privileged users or compromised devices. While the immediate threat is low, kernel developers consider it a high‑severity flaw if the conditions are met.