CVE-2025-39689 Details
Description
In the Linux kernel, the following vulnerability has been resolved: ftrace: Also allocate and copy hash for reading of filter files Currently the reader of set_ftrace_filter and set_ftrace_notrace just adds the pointer to the global tracer hash to its iterator. Unlike the writer that allocates a copy of the hash, the reader keeps the pointer to the filter hashes. This is problematic because this pointer is static across function calls that release the locks that can update the global tracer hashes. This can cause UAF and similar bugs. Allocate and copy the hash for reading the filter files like it is done for the writers. This not only fixes UAF bugs, but also makes the code a bit simpler as it doesn't have to differentiate when to free the iterator's hash between writers and readers.
A vulnerability in the Linux kernel's ftrace functionality has been addressed. The issue arose because the reader functions for set_ftrace_filter and set_ftrace_notrace only added a pointer to the global tracer hash, rather than creating a copy. This pointer remained static across function calls, potentially leading to use-after-free (UAF) vulnerabilities. The vulnerability has been fixed by ensuring that the hash is allocated and copied for reading filter files, similar to the existing behavior for writing. This change not only resolves the UAF issues but also simplifies the code by eliminating the need to manage the hash differently for reading and writing operations.
Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for upgrading the Linux kernel can be found in the official Linux kernel documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-416 | Use After Free | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 4.12, < 5.4.297 >= 5.5, < 5.10.241 >= 5.11, < 5.15.190 >= 5.16, < 6.1.149 >= 6.2, < 6.6.103 >= 6.7, < 6.12.44 >= 6.13, < 6.16.4 6.17 rc1 6.17 rc2 |
CPE
Remediation
| |
| debian debian linux | 11.0 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 30, 2026 | CVE Modified | kernel.org |
| Jun 17, 2026 | CVE Modified | siemens-SADP |
| Jun 17, 2026 | CVE Modified | kernel.org |
| May 12, 2026 | CVE Modified | siemens-SADP |
| Jan 8, 2026 | Initial Analysis | [email protected] |
| Nov 3, 2025 | CVE Modified | CVE |
| Sep 5, 2025 | New CVE Received | kernel.org |