The vulnerability stems from a failure to free a partially allocated trace remote buffer when page allocation fails. The result is a kernel memory leak that can consume system memory and eventually degrade performance or cause system instability, effectively creating a denial‑of‑service condition.

All Linux kernel releases that include the trace_remote subsystem and lack the recent patch are vulnerable. Specific affected version ranges are not disclosed, so any kernel built from the source tree prior to the inclusion of the fix should be considered at risk.

The leak requires the ability to trigger the trace_remote buffer allocation path, which normally occurs via privileged kernel operations. The exploit is a local kernel exploit; it does not rely on network or user‐mode execution. The EPSS score indicates a very low exploitation probability (<1%) and the vulnerability is not listed in the CISA KEV. The CVSS score of 5.5 points to medium severity, signalling a moderate risk to availability for systems that use trace_remote extensively.