The Linux kernel tracing subsystem exposed a use‑after‑free in user_event_mm_dup() when an enabler is registered, unregistered, and a fork is initiated concurrently. This race causes the enabler and its associated user_event to be freed while a reader is still dereferencing them, allowing kernel memory corruption. An attacker who can invoke the user_events interface can trigger this race and potentially achieve arbitrary code execution with kernel privileges.

All Linux kernel releases that include the tracing/user_events subsystem before the patch commits referenced. The specific affected kernel versions are not enumerated in the data, but the vulnerability exists in any kernel containing the user_events tracing code prior to the patch. After applying the commits referenced, subsequent kernel builds no longer contain the race. Based on the description, the attack vector is an unprivileged local process that can invoke the user_events interface.

The CVSS score is 7.8 (High), and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a local attacker who can invoke the user_events interface; no remote entry point is described. The EPSS score is < 1%, indicating a very low but non‑zero probability of exploitation. Based on the description, it is inferred that the attack vector is local and no remote exploitation is described, but the fixed vulnerability could allow privileged code execution if exploited. Nonetheless, the existence of a local race condition that corrupts kernel memory warrants immediate remediation.