The vulnerability stems from trace_module_add_events() ignoring the result of __register_event() and then creating trace_event_file entries for events that failed to register. When a module that added such an event later unloads, the tracing subsystem retains a dangling pointer, which can be dereferenced during subsequent tracefs or tracing operations, resulting in a use‑after‑free. The compromised kernel memory can be exploited to execute arbitrary code or elevate privileges. The weakness is a classic use‑after‑free flaw.

All Linux kernel installations that use the ftrace/tracing subsystem and have the ability to load kernel modules are affected. The issue existed until the patch that checks __register_event() return values was merged into the stable kernel tree. No specific kernel versions are listed in the data, so any current kernel build that has not applied this change is vulnerable.

The EPSS score is < 1% and the vulnerability is not listed in CISA’s KEV catalog, implying no known widespread exploitation in the public domain. However, use‑after‑free vulnerabilities in the kernel can be severe; a local attacker with the ability to load a kernel module can trigger the flaw. The attack vector is inferred to be local, requiring module load or modification capabilities, but the impact could extend to remote exploitation if elevated privileges are gained. The CVSS score is 7.8, indicating a high level of severity.