In the Linux kernel's tracing subsystem, the routine that parses predicates incorrectly calculates the limit for the number of predicates to parse. The routine adds two for terminal TRUE and FALSE entries, but mistakenly uses this increased count as the limit for allocations. If more predicates are parsed than the initial count, the program can overwrite the allocated memory and later accesses can read or write beyond its end, causing a memory corruption event in kernel space. Such an overflow could crash the kernel, corrupt data structures, or be leveraged for executing arbitrary code with kernel privileges.

The vulnerability affects the Linux kernel on any architecture that implements the tracing subsystem prior to the application of the fix. All vendors shipping kernels that include the unpatched tracing code are potentially impacted.

Based on the description, it is inferred that the attack vector is local or privileged, as an attacker would need to trigger the parsing of malicious predicates through the tracing subsystem. The issue is a classic out‑of‑bounds buffer overwrite (CWE‑119). Because the vulnerable code runs in kernel mode, a privileged or local attacker could trigger the overflow by crafting a malicious trace predicate list. If successful, the impact could be denial of service, data corruption, or privilege escalation. No CVSS score is provided, and the EPSS score is unavailable, so the quantified risk is unknown. The vulnerability is not listed in the CISA KEV catalog, but the absence of an EPSS score does not preclude exploitation.