The flaw occurs when a named histogram trigger is inserted into the global list before its reference count is safely incremented. If the trigger’s initialization fails, the trigger is freed while still present in the list, causing subsequent lookups to access freed memory. This results in a use‑after‑free (CWE‑825) that can crash the kernel. Based on the description, an attacker who can control the trigger data could potentially trigger a kernel panic, which might allow escalation of privileges if the attacker already has local code execution.

All Linux kernel releases that have not applied the maintainer’s patch are vulnerable. The affected code resides in the upstream kernel, so every distribution built from a vulnerable kernel version is impacted, regardless of specific distribution. No explicit version range is provided, so users should assume any kernel containing the legacy tracing implementation is at risk.

EPSS score is < 1% and the vulnerability is not listed in CISA KEV, implying no publicly documented exploits. The bug exposes no externally reachable interface; an attacker needs local or privileged access to create a named histogram trigger. While the flaw permits a kernel crash that might lead to privilege escalation, the low EPSS suggests exploitation is unlikely. The CVSS score of 5.5 indicates a medium severity use‑after‑free, but the lack of widespread exploitation data still warrants timely patching.