Kernel fault via dangling dynamic-event fields

Use-after-free in Linux tracing probes allows local users with tracing access to trigger an invalid kernel-memory read through a probe filter. traceprobe_define_arg_fields() passes probe-owned name and type strings to trace_define_field(), which stores their pointers without copying; removing the first of several probes frees those strings while a sibling keeps the event and its field list alive. Writing a filter after that removal dereferences the dangling field pointer, producing a repeatable KASAN kernel fault; reachability requires the ability to modify dynamic tracing events.