The flaw is a NULL pointer dereference (CWE-476) in the Linux kernel's uprobe expiration routine, hprobe_expire. When a task that still holds a pending uretprobe is forked, the cleanup path can dereference a null pointer, causing a kernel oops and reboot. This results in an immediate loss of service for the affected machine.

The defect resides in the core kernel code shared by all Linux distributions. Any kernel version that has not incorporated the recent patch commit is vulnerable. The issue was reproduced on production hosts within the Meta fleet, indicating that recent kernels lacking the fix are at risk.

The likely attack vector is local execution or privilege escalation that forces a process with a dangling uprobe reference to fork. Based on the description, the flaw can be triggered when a fork operation occurs after an uprobe has been unregistered while the task is still alive. The CVSS score is 5.5, the EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. If an adversary can satisfy the prerequisite conditions, the kernel will crash, resulting in a denial of service. Given the exploitation constraints and lack of public exploitation evidence, the risk is considered moderate to high for systems that employ uprobes and perform frequent forking.