CVE-2025-38346
BaseFortify
Publication date: 2025-07-10
Last updated on: 2025-12-16
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 5.11 (inc) to 5.15.186 (inc) |
| debian | debian_linux | 11.0 |
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-416 | The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Use-After-Free (UAF) bug in the Linux kernel's ftrace subsystem. It occurs when a buggy kernel module triggers ftrace to disable tracing (ftrace_disable). When the module is removed, ftrace_release_mod() does not properly clean up because ftrace_disable is set, leaving references to the freed module memory. Later, if /proc/kallsyms is read, it accesses the freed module memory, causing a UAF condition that can lead to kernel crashes or undefined behavior.
How can this vulnerability impact me? :
This vulnerability can cause system instability or crashes due to the kernel accessing freed memory. It may allow an attacker with the ability to load and remove kernel modules to trigger a Use-After-Free condition, potentially leading to denial of service or other unpredictable kernel behavior.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by observing kernel oops messages related to use-after-free (UAF) errors triggered when accessing /proc/kallsyms after a module that caused ftrace to disable has been removed. Specifically, look for kernel logs showing 'BUG: unable to handle page fault' and traces involving ftrace_mod_get_kallsym and module memory access after removal. Commands to check include: 1) Inspect kernel logs with 'dmesg | grep -i oops' or 'journalctl -k | grep -i oops' to find relevant oops messages. 2) Check if ftrace is disabled by examining /sys/kernel/debug/tracing/status or related ftrace control files. 3) Monitor module load/unload events with 'lsmod' and 'dmesg' to correlate with any suspicious behavior. 4) Attempt to read /proc/kallsyms after removing a module to see if it triggers errors.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability immediately, avoid loading or using buggy kernel modules that trigger ftrace_disable. If such modules are already loaded, unload them carefully and avoid accessing /proc/kallsyms until the kernel is patched. Applying the kernel update that fixes the ftrace use-after-free issue is the definitive mitigation. Until then, restrict untrusted module loading and monitor kernel logs for related errors.