The flaw arises in the Linux kernel’s tracing histogram subsystem, where an unbounded memory copy is performed during event trigger parsing. parse_field() incorrectly assigns a stacktrace modifier before validating the field name, and create_hist_field() subsequently selects a stacktrace field based solely on pointer value. event_hist_trigger() then copies a number of longs specified by the event data into a fixed 31‑entry array without bounds checking, leading to a buffer over‑read and subsequent memory corruption. This is a buffer overflow vulnerability, CWE‑120, that can cause kernel crashes or loss of state.

All Linux kernel implementations that expose the tracing histogram feature without the commit series referenced in the supplied kernel tree patches are vulnerable. Distributions and custom kernel builds that have not incorporated the 55caaf2… through e183b84… series of changes will be affected, regardless of kernel version, until the fix is applied.

The CVSS score of 7.0 indicates high severity, while the EPSS score of <1% reflects a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation to date. The likely attack vector is local; an adversary must write to a tracing trigger file such as /sys/kernel/tracing/events/<event>/trigger and supply a .stacktrace modifier. Once activated, the kernel will perform the overflow, potentially destabilizing the system. Given the local requirement and the lack of public exploits, the overall risk remains moderate but non‑negligible, warranting timely patching.