The issue is in the Linux kernel’s fprobe instrumentation. fprobe_fgraph_entry() allocates shadow stack space for each fprobe that has an exit handler, but it only populates that space when the entry handler returns 0. Because fgraph_reserve_data() does not zero the memory, a later call to fprobe_return() interprets the leftover uninitialized data as header information from a prior call. This misinterpretation can cause an exit handler to execute twice or be skipped, altering the intended control flow. The weakness is identified as a misuse of uninitialized data (CWE‑908).

All Linux kernel builds that include fprobe instrumentation are affected. Any kernel that has not incorporated the repository commits that patch this flaw is vulnerable, regardless of release version.

The CVSS score of 4.4 indicates a moderate severity, and the EPSS score of <1% shows a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The flaw is local to the kernel and would require an attacker with local or elevated privileges to trigger misuse of fprobe headers, potentially leading to altered kernel behavior, but no public exploit is documented.