Executive brief
A vulnerability in the Linux kernel's tracing subsystem could allow a local user to crash the system. When multiple software modules are loaded simultaneously, a race condition occurs that can corrupt internal lists used for system monitoring. This results in a kernel crash, impacting the availability of the server or device.
Technical details
A race condition exists in kernel/trace/trace_events.c due to missing synchronization when adding trace events to the ftrace_events list. When a module is loaded, it registers trace events and may modify printk format strings; if two modules are loaded concurrently, the lack of write-side locking on trace_event_sem allows for list corruption during iteration. An attacker with local access and the ability to trigger module loading could exploit this to cause a Denial of Service (kernel panic). The fix introduces down_write(trace_event_sem) during event registration to ensure exclusive access to the list.
Affected products
- Linux Linux Kernel 2.6.31 to 6.1.147
Timeline
- 2025-07-18: disclosed: Vulnerability reported and patch authored
- 2025-07-24: patched: Patch committed to stable tree
- 2025-08-16: advisory: CVE published
References
- https://git.kernel.org/stable/c/33e20747b47ddc03569b6bc27a2d6894c1428182
- https://git.kernel.org/stable/c/6bc94f20a4c304997288f9a45278c9d0c06987d3
- https://git.kernel.org/stable/c/70fecd519caad0c1741c3379d5348c9000a5b29d
- https://git.kernel.org/stable/c/7803b28c9aa8d8bd4e19ebcf5f0db9612b0f333b
- https://git.kernel.org/stable/c/b5e8acc14dcb314a9b61ff19dcd9fdd0d88f70df
- https://git.kernel.org/stable/c/ca60064ea03f14e06c763de018403cb56ba3207d
- https://git.kernel.org/stable/c/db45632479ceecb669612ed8dbce927e3c6279fc