The patch discussion reveals that a use‑after‑free occurs in the Linux kernel’s tracing subsystem because the freeing of event trigger data was moved to a kthread that performs tracepoint synchronisation after the data is queued for deletion. Concurrent tracepoint handlers can therefore access the freed memory through the list_del_rcu()'d trigger, causing undefined behaviour. This flaw matches the typical use‑after‑free vulnerability category (CWE‑416) and could manifest as a kernel crash or, in the worst case, allow an attacker to execute code with kernel privileges if they can trigger the problematic tracepoint. The vulnerability is limited to the parts of the tracing module that free hist_data, cmd_ops, and enable_data immediately after calling trigger_data_free. When the graceful kthread freed the data, a concurrent handler could continue to reference the memory and invoke callbacks that no longer exist, creating a window for exploitation. The CVE description does not provide a CVSS score, EPSS value, or KEV status. Therefore, while the theoretical severity is high, the actual risk depends on an attacker’s ability to exploit kernel‑space faults. A local attacker with the ability to trigger tracepoints or inject malicious tracepoint handlers would face the attack vector, allowing either denial of service via a crash or potential privilege escalation if code execution can be coerced. Based on the provided information, the risk is considered high but unproven, with exploitation contingent on advanced knowledge of the tracing subsystem and kernel internals. Proper patching or mitigation is recommended before any attempt at exploitation.

Any Linux kernel build that includes the tracing subsystem and predates the patch commit 61d445af0a7c. The flaw affects the handling of event_hist_trigger_free, event_hist_trigger_named_free, and event_enable_trigger_free, so all kernels that expose these triggers via tracepoints before the fix are potentially vulnerable. No exact version list is provided, but any kernel version lacking the commit that defers freeing to a kthread is at risk.

The CVSS score is not available and the EPSS score is not provided, so the likelihood of exploitation is uncertain. However, the nature of a use‑after‑free in kernel space typically denotes a high‑severity vulnerability (CWE‑416). Exploitation requires the attacker to trigger tracepoint handlers or otherwise interact with the freed data, which is typically feasible only from local code execution or from an attacker who can influence kernel tracepoint activity. The vulnerability is not listed in CISA KEV, and no public exploits have been recorded, but given its kernel context it remains a high‑risk item.