The kernel’s tracing subsystem incorrectly defers a call to trace_event_put_ref() in a trigger free kthread while the associated trace_event_file may already have been freed during instance removal. This use‑after‑free can corrupt memory and, in the worst case, allow a local attacker with kernel privileges to execute arbitrary code. No CVSS score is available, but the bug is a classic use‑after‑free.

The issue affects all Linux kernel releases that expose the affected tracing API until the fix is integrated. The vendor information lists Linux kernel broadly without a specific version range, so any production kernel that has not yet been updated to the commit set that removes the dereference is at risk. Kernel maintainers should verify if the commit IDs 67fb91a7f7bb1d958cf9cc249c912bca9b2fc821 or bcfe2816e6ec46c3f4c58aa4264476665ddb3f69 are present in the running kernel.

EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. Consequently, the likelihood of exploitation is uncertain. The bug requires a local kernel‑level trigger to occur, so the most likely attack vector is a local attacker with elevated privileges. Because the flaw is a use‑after‑free, it could lead to memory corruption, privilege escalation, or denial of service, depending on how the freed memory is subsequently used.