This Linux kernel vulnerability is a race condition in the tracing subsystem, specifically during concurrent resizing of subbuffers that interact with trace_pipe_raw readers. If a resize occurs while a reader is accessing stale size information, the kernel may crash or a user‑space process may read uninitialized memory, leading to potential denial of service or leakage of sensitive data. The flaw involves improper synchronization between ring_buffer_alloc_read_page, ring_buffer_read_page, and ring_buffer_subbuf_size_get.

Affected systems include any Linux kernel installation that implements the trace_pipe_raw interface and performs subbuffer resizing. Because the patch is applied to all current kernel releases, older kernels before the commit that introduced ring_buffer_read_page_size are potentially vulnerable, regardless of vendor.

The CVSS score of 7.0 indicates a high severity, while the EPSS of <1% shows a low current exploitation probability. The vulnerability is not listed in CISA KEV, so no publicly known exploits are reported. Exploitability likely requires local access to trace_pipe_raw, which can be granted to any process that reads tracing data. An attacker could trigger a crash or cause memory exposure by inducing concurrent subbuffer resizing, resulting in denial of service or sensitive information leakage.