CVE-2025-39683: Linux Kernel slab-out-of-bounds read in ftrace tracing subsystem

CVE-2025-39683 · Severity: high · CVSS 7.8 · Published 2025-09-05

A vulnerability exists in the Linux kernel's tracing subsystem, which is used by administrators and developers to monitor system performance and behavior. An attacker with local access to the system could provide a specially crafted, overly long input to the tracing configuration that causes the system to read memory outside of its intended boundaries. This could lead to a system crash (denial of service) or potentially allow the attacker to view sensitive information stored in the system's memory.

Technologies: Linux Kernel, Siemens SIMATIC CN 4100, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP. Vendors: Linux, Siemens.

Quick answers

Is CVE-2025-39683 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-39683 being exploited in the wild.
How severe is CVE-2025-39683?
High severity, with a CVSS score of 7.8, published 5 September 2025.
Which products and versions are affected?
Linux Kernel 4.4.269 to 4.5, 4.9.269 to 4.10, 4.14.233 to 4.15, 4.19.191 to 4.20, 5.4.118 to 5.5, 5.10.36 to 5.10.241, 5.11.20 to 5.12, 5.12.3 to 5.15.190, 5.16 to 6.1.149, 6.2 to 6.6.103, 6.7 to 6.12.44, 6.13 to 6.16.4, 6.16.0-g6bcdbd62bd56-dirty and earlier versions; Siemens SIMATIC CN 4100 before V5.0; Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5 and later; Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5 and later; and 1 more.
Is there a fix for CVE-2025-39683?
A patch was published on 2025-08-23: Initial patch authored by Pu Lehui Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-39683 attacked?
It is attacked with local access, in an operating system.
Am I affected by CVE-2025-39683?
Check whether you run Linux Kernel, Siemens SIMATIC CN 4100, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An out-of-bounds (OOB) read vulnerability exists in the Linux kernel tracing subsystem due to improper error handling in the 'trace_get_user' function. When a user writes a string exceeding FTRACE_BUFF_MAX to 'set_ftrace_filter', 'trace_get_user' fails but neglects to null-terminate the 'parser->buffer'. Subsequent calls to 'ftrace_regex_release', 'ftrace_process_regex', and 'strsep' then trigger an OOB access when searching for delimiters. This is a local vulnerability requiring low privileges. Patches have been released for various stable kernel branches (e.g., 6.1.y, 5.15.y, etc.) to implement a failure flag that limits buffer access upon error.

Affected products

  • Linux Linux Kernel 6.16.0-g6bcdbd62bd56-dirty and earlier versions
  • Siemens SIMATIC CN 4100 before V5.0
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5 and later
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5 and later
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5 and later

Timeline

  • 2025-08-23: patched: Initial patch authored by Pu Lehui
  • 2025-09-05: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.