CVE-2025-39689CWE-416

CVE-2025-39689

High · published September 5, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
7.6
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

ftrace: Also allocate and copy hash for reading of filter files

Currently the reader of set_ftrace_filter and set_ftrace_notrace just adds

the pointer to the global tracer hash to its iterator. Unlike the writer

that allocates a copy of the hash, the reader keeps the pointer to the

filter hashes. This is problematic because this pointer is static across

function calls that release the locks that can update the global tracer

hashes. This can cause UAF and similar bugs.

Allocate and copy the hash for reading the filter files like it is done

for the writers. This not only fixes UAF bugs, but also makes the code a

bit simpler as it doesn't have to differentiate when to free the

iterator's hash between writers and readers.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00184 · 7.6th percentile
Weakness
CWE-416 · Use After Free
Published
2025-09-05T22:15Z
Affected products (10)
ProductVersionsFixed in
linux/linux_kernel≥ 4.12, < 5.4.2975.4.297
linux/linux_kernel≥ 5.5, < 5.10.2415.10.241
linux/linux_kernel≥ 5.11, < 5.15.1905.15.190
linux/linux_kernel≥ 5.16, < 6.1.1496.1.149
linux/linux_kernel≥ 6.2, < 6.6.1036.6.103
linux/linux_kernel≥ 6.7, < 6.12.446.12.44
linux/linux_kernel≥ 6.13, < 6.16.46.16.4
linux/linux_kernelall versions—
linux/linux_kernelall versions—
debian/debian_linuxall versions—
References (12)
EPSS history
Timeline
  • 05 SEP 17:20Z
    ftrace: Also allocate and copy hash for reading of filter files
    cvelistv5