In the Linux kernel tracing subsystem, concurrent resizing of subbuffers can cause trace_pipe_raw readers to use a stale size value. This race condition may crash the kernel or result in uninitialized memory being exposed to user space. The affected code includes ring_buffer_alloc_read_page and ring_buffer_read_page, leading to data integrity and availability problems.

All Linux kernel deployments that use the trace_pipe_raw interface and perform subbuffer resizing are vulnerable. The precise kernel releases are not listed, but the mitigation applies to any kernel that implements the described tracing logic prior to the fix.

The Expected Path to Exploitation score is not available, and the vulnerability is not in the CISA KEV catalog, suggesting no publicly documented exploits. The risk is considered moderate to high because a kernel crash can deny service and leaked uninitialized data may expose sensitive information. The attack vector, inferred from the description, is likely local or through any process with read access to trace_pipe_raw, potentially allowing remote impact if the trace interface is exposed.