The vulnerability resides in the Linux kernel ftrace subsystem. When a child process is created, the parent’s function graph state is copied, but the child does not initialize its own state before the parent may be freed. This results in a use‑after‑free condition, as demonstrated by KASAN reports of a slab-use‑after‑free. The corrupted memory can lead to kernel memory corruption and potentially cause a kernel panic.

All Linux kernels that use the vulnerable ftrace implementation are affected. The CVE data does not specify a version range, but the issue was remedied in the commits 08cacffeef8f64f1a222c93467ca84f24a46c953 and 1fadebbbf31f65beba353fa9d1373bf183e03fed.

The CVSS score of 7.8 reflects high severity, and the EPSS score is less than 1%, indicating a low but non‑zero likelihood of exploitation. An attacker with local system access can potentially trigger the flaw by creating processes that result in the specific fork sequence described. This would cause the kernel to corrupt memory or crash, but no explicit elevation of privilege or remote exploitation is documented in the CVE description. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog.