CVE-2025-38539

CVE-2025-38539

High · published August 16, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
7.1
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

tracing: Add down_write(trace_event_sem) when adding trace event

When a module is loaded, it adds trace events defined by the module. It

may also need to modify the modules trace printk formats to replace enum

names with their values.

If two modules are loaded at the same time, the adding of the event to the

ftrace_events list can corrupt the walking of the list in the code that is

modifying the printk format strings and crash the kernel.

The addition of the event should take the trace_event_sem for write while

it adds the new event.

Also add a lockdep_assert_held() on that semaphore in

__trace_add_event_dirs() as it iterates the list.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00179 · 7.1th percentile
Published
2025-08-16T16:15Z
Affected products (14)
ProductVersionsFixed in
linux/linux_kernel≥ 2.6.31, < 5.4.2975.4.297
linux/linux_kernel≥ 5.5, < 5.10.2415.10.241
linux/linux_kernel≥ 5.11, < 5.15.1905.15.190
linux/linux_kernel≥ 5.16, < 6.1.1476.1.147
linux/linux_kernel≥ 6.2, < 6.6.1006.6.100
linux/linux_kernel≥ 6.7, < 6.12.406.12.40
linux/linux_kernel≥ 6.13, < 6.15.86.15.8
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
debian/debian_linuxall versions—
References (10)
EPSS history
Timeline
  • 16 AUG 11:12Z
    tracing: Add down_write(trace_event_sem) when adding trace event
    cvelistv5