A race condition exists while a tracer option file is opened in the Linux kernel. The kernel takes a reference to a trace_array element, but if that element is freed before the reference is taken, the kernel reads freed memory, leading to a use‑after‑free that can crash the kernel or corrupt internal state. This weakness is classified as exposure of uninitialized memory during race conditions (CWE‑825).

All current Linux kernel releases prior to the patch adding trace_array_tracer_options_get() are affected. The flaw is present in the tracing subsystem across the kernel source tree, so any active kernel instance that has not been updated to the fixed version is vulnerable.

The CVSS score of 7.0 indicates moderate severity. The EPSS score of < 1% and the fact that the vulnerability is not listed in CISA KEV both suggest a low probability of widespread exploitation. The likely attack vector involves a process that can open tracer option files, which normally requires privileged or administrative rights. Based on the description, it is inferred that an attacker would need kernel‑level or root privileges to trigger the race and cause a kernel crash, resulting in denial of service for the affected system.