A NULL pointer dereference occurs in the kernel function fprobe_fgraph_entry() when a newly registered fprobe becomes visible between two RCU‑protected traversals of the per‑address fprobe list. The second traversal attempts to write to a buffer that was not sized during the first walk, causing a general protection fault and a kernel panic. The fault originates in tracing code that is executed only when the ftrace/fprobe subsystem is enabled. This manifests as a kernel crash that disrupts system operation and can be triggered by any action that loads or modifies fprobe entries.

All Linux kernel releases that have not yet incorporated the three commits referenced in the advisory—367c49d6e283c17b56a31e7a8d964a079244264c, 62988204162fc382cfc7d9a185d40a751261e3a3, or d655cca1c6e67eb081214d37eb231a869ead2f97. In practice this includes many distributions still shipping older Kernels or embedded devices that have not applied the patch.

The CVSS score is 5.5, and the EPSS score is < 1%. The vulnerability is not listed in CISA’s KEV catalog. Triggering the fprobe mechanism requires kernel‑level privileges, typically root or CAP_SYS_ADMIN, because adding an fprobe entry or manipulating the function‑graph table is restricted. Once an attacker can perform such an action, the kernel will crash, resulting in a denial of service for all users. No public exploit code is known, so the likelihood of exploitation in the wild is currently uncertain, but a local privileged adversary could exploit the flaw.