In the Linux kernel, the trace array handling for tracer option files releases a reference to an element of the trace_array's topts array only after that element has potentially been freed. This race condition can lead to a use‑after‑free, allowing an attacker to coerce the kernel into dereferencing stale memory and potentially causing a crash or compromising kernel integrity. The weakness is a classic memory corruption flaw that can destabilize the operating system.

All Linux kernel distributions contain the affected trace subsystem. The vulnerability is present in any kernel that has not yet been updated with the patch that introduces the trace_array_tracer_options_get() helper. No specific version ranges are listed, so any kernel before the fix is potentially vulnerable.

The EPSS score is not available and the vulnerability is not currently listed in CISA KEV. With no published exploits, the risk is largely theoretical. However, because the flaw can result in a kernel crash, the impact could be severe if an attacker has local privileged access to manipulate tracer instance creation and deletion. The likely attack vector requires a process with permission to open tracer option files, which normally implies root or a user with elevated capabilities. Consequently, the overall risk is moderate to high for systems with exposed tracer configuration or those allowing privileged users to configure trace instances.