A use‑after‑free flaw exists in the Linux kernel’s tracing framework when multiple probes are attached to the same event. The kernel stores pointers to probe argument name and type strings instead of copying them; if the first probe in a multi‑probe event is removed, those strings are freed while other probes still reference them. Subsequent field lookups on the event then read freed memory, triggering a kernel memory corruption that can lead to a crash or potentially enable privileged exploitation.

The flaw affects the Linux kernel, specifically the tracing/probes subsystem that handles kprobe, uprobe, eprobe, and fprobe events. No specific kernel version information is supplied in the report, so any affected kernel that lacks the applied fix may be vulnerable.

The CVSS score is not provided, and the EPSS score is unavailable, so the precise severity and exploitation probability remain unknown. The flaw is listed as not part of CISA’s KEV catalog. Because interaction with probe events requires write access to /proc/kprobe_events, the attack likely requires elevated privileges; an attacker with such access could create and then remove probes to trigger the use‑after‑free. The absence of a race condition simplifies exploitation, as the vulnerable state is deterministic after the first probe is deleted.