The Linux kernel contains a race condition that allows tracepoint callbacks—specifically trace_dma_fence_signaled, trace_dma_fence_wait_end, and trace_dma_fence_destroy—to dereference a null fence->ops pointer after a fence has been reset during signalling. This null‑pointer dereference can crash the kernel, resulting in a denial of service for the affected system. The vulnerability is a classic Null Pointer Dereference (CWE‑476).

All Linux kernel vendors are potentially impacted, as the issue is part of the core kernel source. The affected versions are those containing the unpatched dma‑fence tracepoint code; no specific version range is listed, so any release lacking the commit 4e01fc9a5bc49b04fad403ffa71299b35e132ca8 is vulnerable.

The CVSS score is 5.5, and the EPSS score is less than 1%, but the problem is not listed in CISA’s KEV catalog. The likely attack vector is local kernel access, such as a privileged process or kernel module that triggers the offending tracepoints. A successful exploit would cause a kernel panic or loss of service rather than remote code execution. The risk is moderate for environments where local privilege escalation is achievable or where untrusted drivers can be loaded.