The flaw arises in the UFS driver’s tracing code, where a pointer to the host bus adapter (hba) structure is stored in a trace event and later dereferenced in TP_printk() when the trace is read from /sys/kernel/tracing/trace. Because the event may be consumed long after the hba has been freed, the kernel may dereference invalid memory, leading to a crash and a system-wide panic. The vulnerability is a classic use‑after‑free scenario that can affect any kernel process that reads the trace output.

All Linux kernel builds that include the original UFS tracing implementation in drivers/ufs/core/ufs_trace.h are affected. This includes kernels shipped by major distributions that have not yet incorporated the patch and is independent of the architecture. No specific version stamps are listed; the flaw existed until the code was updated to store the device name directly in the ring buffer instead of the hba pointer.

The EPSS score is not available and the CVE is not listed in the CISA KEV catalog. The required conditions for exploitation are local access to the kernel trace file and the presence of the vulnerable trace logic. A privileged user who can trigger a UFS trace event and then read /sys/kernel/tracing/trace could force a kernel panic. It is a high‑consequence flaw because it results in a full system reboot, but the likelihood of exploitation is uncertain due to the lack of a public EPSS or CVSS metric.