The vulnerability involves the Linux kernel tracing subsystem's handling of histogram triggers with identical names on different events. When two hist triggers share the same name, the second reuses the first's named_data, but the freeing of the second's hist_data does not remove its entry from the hist_vars list, leaving a dangling pointer. Subsequent access to this freed memory by a later hist trigger causes a use-after-free condition, leading to kernel panic. The flaw is reproducible from userspace by writing three specific hist triggers to tracefs. The fix removes the hist_data from the hist_vars list and releases the trace_array reference before freeing hist_data in the named-data branch of hist_register_trigger().

Exploitation of this vulnerability causes a kernel panic, resulting in a denial of service by crashing the system. The use-after-free condition can be triggered from userspace, making it possible for local users to cause system instability or crashes.

A fix has been implemented that properly removes the freed hist_data from the hist_vars list and releases associated references before freeing memory. Users should apply the official kernel patch that addresses this issue. Since the vulnerability affects the Linux kernel, remediation involves updating to a fixed kernel version once available. Patch status is not yet confirmed in the provided data; check the vendor advisory for current remediation guidance.