A race condition exists during the loading of kernel modules in the tracing subsystem. When two CPUs concurrently load modules, one path updates event fields while the other defines new event fields without holding the same mutex, leading to unsynchronised access to the event class’s fields list. This can dereference a null or corrupted pointer and trigger a kernel panic. The impact is a local denial of service: a compromised kernel will crash and require a reboot, potentially allowing an attacker to disrupt high‑availability systems or use the crash to pivot to further attacks.

The vulnerability affects the Linux kernel’s tracing subsystem on all versions that did not incorporate the commit fixing the race. Both the generic Linux kernel and custom builds that include the standard tracing module are potentially impacted. No specific version numbers are listed in the CVE data.

The CVSS score of 5.5 indicates moderate severity. The EPSS score of <1% suggests a very low but nonzero exploitation probability. The kernel crash represents a moderate flaw that requires the ability to load or unload a kernel module, which is typically restricted to privileged users. Therefore, the practical exploitability is low to moderate, limited to privileged local attackers who can control module loading. The vulnerability is not listed in CISA’s KEV catalog.