In the Linux kernel, the osnoise tracer fails to call synchronize_rcu() during unregistration, which means that RCU readers still traversing the tracer instance list may dereference a tracer that has already been freed. This results in a use‑after‑free condition. Based on the description, it is inferred that this flaw could allow an attacker to crash the kernel or, if able to trigger the fault, execute code with kernel privileges, although specific conditions are not detailed in the advisory.

All Linux kernel releases prior to the inclusion of the referenced commits are affected. The advisory lists no explicit version range; therefore any kernel version not yet patched is considered vulnerable.

The CVSS score is 7.8, indicating a high severity. The EPSS score is below 1%, indicating a very low overall exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The risk is moderate to high if the system allows local or software‑initiated actions that can trigger tracer unregistration while RCU readers are active, as the inferred impact could lead to a kernel crash or privilege escalation. The lack of a publicly available exploit means immediate threat is low, but the defect poses a significant potential risk if advanced attackers target the kernel.