The bug lies in the Linux kernel kprobe subsystem’s handling of optimized probes. When a new probe is armed close to an existing disabled (disarmed) probe, the routine stops at the disabled probe and writes a breakpoint into the last byte of a preceding probe’s jump instruction. This corrupts the jump and causes execution to be redirected to an unintended address, effectively allowing an attacker to execute arbitrary code at kernel level. The weakness is an improper validation of probe states and mismanagement of in‑kernel code patching, leading to a kernel execution vulnerability.

All Linux kernel releases that include the optkprobe optimization are affected. No exact version numbers are listed, so any kernel that implements kprobes and the optkprobe optimization could be impacted.

The CVSS score of 4.4 indicates moderate severity, but the nature of the flaw—kernel‑level code execution—implies significant risk. EPSS score is < 1% and the issue is not listed in the CISA KEV catalog, so exploitation is not currently known. The attack vector requires a privileged user to arm kprobes, so local privilege escalation or a privilege‑escalating exploit that enables probe manipulation would be required. If a system remains on an unpatched kernel, an attacker with the requisite privileges could easily trigger the bug and run code in kernel context.