The kernel tracing subsystem exposed a use‑after‑free in user_event_mm_dup(). When a task registers an enabler, unregisters it, and initiates a fork, the cleanup path deletes the enabler and its associated user_event before an RCU grace period, leaving dangling pointers. A reader can dereference the freed memory during clone, causing kernel memory corruption. An attacker who can invoke the user_events interface can trigger this race to corrupt kernel state, potentially enabling arbitrary code execution with kernel privileges. This flaw aligns with CWE‑416 (Use After Free).

All Linux kernel releases that ship the tracing/user_events subsystem before the fix commits (listed in the provided references). The specific affected kernel versions are not enumerated in the data, but the vulnerability exists in any kernel containing the user_events tracing code prior to the patch. After applying the commits referenced, subsequent kernel builds no longer contain the race.

The CVSS score is not supplied, but the use‑after‑free is a high‑severity kernel flaw and is listed as not in the CISA KEV catalog. Exploitation requires a local attacker who can perform user_events calls; no remote entry point is described. The EPSS score is unavailable, so the current probability of exploitation is unknown. Nonetheless, the presence of a local race condition that corrupts kernel memory warrants immediate remediation.