A NULL pointer dereference occurs in the Linux kernel tracing subsystem when a user switches to a tracer that defines neither static nor default flags such as hwlat, irqsoff, or wakeup. The kernel assigns a null pointer to tr->current_trace_flags, but the ring buffer still contains entries from the previous tracer. When print_graph_function_event attempts to print one of these entries, it dereferences the null pointer, causing a kernel null pointer fault and a system panic, leading to a denial of service.

The vulnerability affects all Linux kernel versions prior to the patch that introduced a non‑NULL fallback for tr->current_trace_flags. The issue resides in the generic tracing infrastructure and is not limited to a specific architecture or distribution; any kernel that implements the affected tracing logic is susceptible.

The CVSS score is not disclosed in the input, and EPSS is not available. The vulnerability is listed as not in the CISA KEV catalog. Because the bug is triggered by writing to /sys/kernel/tracing, it requires local access that typically implies at least user with elevated privileges. Once exploited it causes an immediate kernel crash, leading to a denial of service rather than remote code execution. No publicly documented exploits exist, but the nature of a kernel panic makes it a serious local privilege escalation vector.