The Linux kernel bug originates from fprobe_fgraph_entry() reserving shadow stack space for each fprobe with an exit handler but only populating it when the entry handler returns 0. Because the reservation routine does not clear the memory, subsequent calls to fprobe_return() misinterpret leftover headers. This can cause an exit handler to execute twice or be skipped entirely. The unintended execution or omission of kernel instrumentation hooks can lead to logic errors, potential denial‑of‑service, or, in privileged contexts, kernel‑level code execution.

The flaw is confined to the Linux kernel. All builds of the kernel that include the fprobe instrumentation are potentially affected, until the patch that writes a terminating zeroed slot (commits c/1d653a183973f5 and c/b7459fddcb27a4b7) is applied. The vulnerability description does not specify a particular kernel version; therefore, any running kernel prior to the fix is considered at risk.

The available metrics do not list an EPSS score or a KEV designation, and the CVSS score is not provided. Because fprobe is generally used for debugging and profiling, exploiting the defect would most likely require local presence with the ability to spawn or influence processes that use fprobe hooks, making a local or privilege‑escalation attack vector plausible. In the absence of an exploit report, the risk remains medium to high for systems that have fprobe enabled and run a vulnerable kernel version, but the lack of publicly available exploits suggests a low to moderate exploitation probability at present.