This is a local kernel race condition in the osnoise tracer's instance list management. The bug: RCU readers traverse the tracer instance list while unregister path executes without synchronize_rcu(), allowing a use-after-free when a reader holds a reference to a freed instance. The fix is one synchronize_rcu() call — surgical, but it confirms this was a missed synchronization point, not a systemic memory management failure.
The 7.8 CVSS score clashes with an EPSS of 0.00163, and that gap is analytically meaningful. This is not a remotely exploitable vulnerability — exploitation requires local kernel context, precise timing to win the race window, and a tracer that may not even be enabled in most production environments. The CVSS vector implicitly assumes exploitability is separable from difficulty, but for RCU race conditions in tracing code, they are entangled.
What matters practically: check if osnoise tracer is loaded (grep osnoise /sys/kernel/tracing/available_tracers or /proc/cmdline for trace_options). If it's not in your config, this is lower priority. If it is enabled, prioritize the patch — the blast radius of winning this race is full system compromise, every credential on the host, every container boundary. The exploitability may be near-zero, but the impact ceiling is maximal.
The deeper concern: osnoise landed in 2021 and sits atop RCU infrastructure that predates it. The missing synchronize_rcu() likely stems from performance pressure — synchronize_rcu() adds microseconds of overhead, and for a tracer designed to measure fine-grained latency, that trade-off was made consciously. This pattern recurs in performance-sensitive tracing code. Audit your kernel configs for tracing features you don't need, and treat this CVE as a signal that the osnoise subsystem may have other implicit RCU assumptions worth reviewing. The EPSS may be low not because the vulnerability class is unimportant, but because these bugs are structurally undercounted in the data EPSS draws from — static analysis struggles with non-local RCU semantics, and race windows require specific CPU states that standard fuzzing misses. Assume higher uncertainty than the CVSS-EPSS gap implies.