A failure in the Linux kernel ftrace direct multi module can cause a kernel crash when the module is unloaded. In the initialization function, the result of kthread_run() is assigned to a task pointer without verifying if the function returned an error pointer. If the thread creation fails, the function returns ERR_PTR(-ENOMEM), but the module reports success and continues to load. When the module is later unloaded, the exit function passes this erroneous pointer to kthread_stop(), causing a null‑pointer dereference in the kernel. This results in a crash that can bring the affected system down, effectively denying service for the machine or host.

The affected product is the Linux kernel, specifically those releases that include the ftrace_direct_multi module, which is part of the mainline samples. No specific version numbers are supplied, but any kernel that has not incorporated the described fix is vulnerable. The issue applies to all vendor distributions that ship the unpatched kernel.

The EPSS score is below 1 %, indicating a very low probability of exploitation derived from current threat data. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires local, privileged access to load or unload kernel modules, typically available only to root or users with CAP_SYS_MODULE. As a result, the attack vector would be local, and the risk is mitigated by limiting privileged access. Nonetheless, the crash severity (kernel fault) makes it a high‑impact local vulnerability if an attacker can execute the exploit path.