In a recent update to the Linux kernel, a faulty sequence in the user event tracing subsystem caused the event’s fields to be prematurely destroyed before the event removal could be confirmed. If the visibility change of the event fails—typically because the event remains active—trace removal aborts with an error, but the field list has already been cleared and freed. The result is that the event stays registered and fully visible in tracefs, yet subsequent operations on the event work against an empty or dangling field list, which can lead to malformed trace data or crashes. Based on the description, it is inferred that the flaw represents a state‑consistency error that could allow a local attacker to disrupt tracing functions, potentially leading to denial of service or misuse of trace contents.

The vulnerability affects any Linux system running kernel versions prior to the commit that fixed the issue. No specific distributions or patch levels are listed, so all builds of the kernel that are older than the corrective commit are potentially impacted.

The CVSS score is 5.5, and the EPSS score indicates a low exploitation probability of < 1%, with the vulnerability not listed in CISA KEV. Based on the description, it is inferred that exploiting the flaw would likely require control over the user event subsystem, such as local privilege escalation or a compromised kernel process. Because the flaw manifests only when a trace event removal fails, exploitation is not trivial and may be difficult to trigger reliably. Nonetheless, the inconsistency can lead to data corruption or crashes in tracing tools, making the risk significant for systems that rely heavily on kernel tracing for debugging or performance monitoring.