Junglewise Threat Intelligence

CVE-2025-39813: Linux Kernel race condition in ftrace_dump_one

CVE-2025-39813 · Severity: medium · CVSS 4.7 · Published 2025-09-16

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A race condition in the Linux kernel's ftrace component can cause a system warning or potential instability when diagnostic tools are used simultaneously. This occurs when the system attempts to dump trace data while another process is reading the same data stream. While primarily a stability issue, it could be used by a local attacker to trigger kernel warnings and disrupt system monitoring or debugging operations.

Technical details

A race condition exists in `ftrace_dump_one()` when it is called concurrently with a reader of `trace_pipe`. The vulnerability is rooted in the sequence between `trace_empty()` and `trace_find_next_entry_inc()`. If a concurrent reader consumes the ring buffer data after `trace_iterator_reset()` (which sets `len` and `size` to 0) but before `trace_find_next_entry_inc()`, the latter returns NULL. This results in `trace_printk_seq()` being called with an unpopulated iterator where `len >= size`, triggering a `WARN_ON_ONCE`. The fix moves the `trace_printk_seq()` call inside a conditional block that ensures the entry was successfully found and the iterator populated.

Affected products

  • Linux Linux Kernel versions from 2.6.28 up to (excluding) 5.4.298; versions from 5.5 up to (excluding) 5.10.242; versions from 5.11 up to (excluding) 5.15.191; versions from 5.16 up to (excluding) 6.1.150; versions from 6.2 up to (excluding) 6.6.104; versions from 6.7 up to (excluding) 6.12.45; versions from 6.13 up to (excluding) 6.16.5

Timeline

  • 2025-08-22: patched: Initial patch submitted to kernel.org
  • 2025-09-16: disclosed: CVE published

References