A fault in the Linux kernel’s tracing subsystem allows a kernel‑space use‑after‑free when a histogram trigger is created with an invalid clock string. The invalid clock causes initialization to fail after the trigger has already been registered, so the now‑freed trigger object remains on the global trigger list. A subsequent lookup reads the freed memory, triggering a KASAN crash and exposing kernel memory corruption. This flaw can be leveraged by a local user with write access to the trigger interface to corrupt kernel data or potentially execute arbitrary code at elevated privileges.

All Linux kernels that include the tracing subsystem prior to the fix. No specific kernel release versions are enumerated in the CVE data, so the vulnerability may exist in any kernel build that has not applied this patch.

The vulnerability is a classic use‑after‑free (CWE‑416), which is highly exploitable for privilege escalation. The EPSS score is not provided, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread exploitation yet. The attack vector likely requires a local user to write to /sys/kernel/tracing/events/.../trigger with an intentionally malformed clock value; thus it is a local, file‑system‑based vector. With sufficient local system access, an attacker could trigger the use‑after‑free to corrupt memory and potentially gain kernel‑level execution.