The Linux kernel contains a flaw in the calculation of sub-buffer array indices for persistent ring buffers. The function responsible for determining the index of a sub-buffer can return a value one too high. This in turn causes the initialization routine to write identifiers shifted by one position, leaving the first entry null. When a userspace process maps the trace_pipe_raw channel, the kernel attempts to dereference this null entry, leading to a potential memory fault. The injected miscalculations can also corrupt internal metadata, causing future boots to discard previous trace data and potentially triggering additional kernel crashes. Ultimately, the vulnerability enables a local user to cause a kernel panic or data corruption, leading to denial of service and loss of trace information.

The issue affects all Linux kernel builds previously released before the patch. The recommended fix is to update to a kernel version that contains the corrected rb_meta_subbuf_idx and related routines. This applies to mainstream distributions and custom installations that use the upstream kernel source.

The vulnerability lacks an EPSS score and is not listed in the CISA KEV catalog, but its nature—an unchecked array index leading to a null dereference in kernel space—implies a moderate to high severity. Exploitation requires local access to a system with persistent ring buffers enabled; the attacker must trigger a trace_pipe_raw mapping to cause the crash. While no publicly demonstrated exploits exist, the mechanics are straightforward for an attacker with privileged read access to kernel memory and the ability to invoke the trace subsystem. Given the potential for a kernel panic, the risk is significant for systems where uptime and trace data integrity are critical.