The Linux kernel trace subsystem contains a stack overflow that occurs during predicate_parse() when an operator stack entry is accessed before processing opening parentheses. The bug allows an out‑of‑bounds write beyond the top of the operator stack, potentially corrupting kernel memory and enabling the execution of arbitrary code in kernel mode. This is a classic buffer overflow (CWE-120) that can compromise confidentiality, integrity, and availability of the affected system.

All Linux kernel implementations are vulnerable; the CVE references the main kernel tree, and no specific versions were listed as unaffected or affected, indicating that any deployed kernel could be impacted until patched.

The vulnerability is not yet listed in the CISA KEV catalog and its EPSS score is not available, suggesting limited public exploitation data at this time. However, the nature of the flaw—in kernel memory—entails a high potential to aid local privilege escalation or remote code execution if an attacker can inject crafted trace data. The likely attack vector is a local or remote user with access to the tracing subsystem, such as an unprivileged process that can write to tracefs or an eBPF program. The CVSS score is unspecified, but the severity is inferred to be high due to the kernel context.