CVE-2025-39974
BaseFortify
Publication date: 2025-10-15
Last updated on: 2025-10-16
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.17.0-rc6 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a slab-out-of-bounds error in the Linux kernel's tracing/osnoise component, specifically in the _parse_integer_limit() function. It occurs when writing to the /sys/kernel/debug/tracing/osnoise/cpus file using the write() syscall without properly null-terminating the input buffer. The function bitmap_parselist() expects the input buffer to end with a '\0' or '\n', but this was not ensured, leading to an out-of-bounds read and a potential kernel memory corruption.
How can this vulnerability impact me? :
This vulnerability can cause a kernel slab-out-of-bounds read, which may lead to kernel memory corruption, system instability, crashes, or potential escalation of privileges if exploited. It affects the stability and security of the Linux kernel when the osnoise cpus interface is written to improperly.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by attempting to write to the /sys/kernel/debug/tracing/osnoise/cpus file with a CPU list string that is not properly null-terminated, which may trigger a KASAN slab-out-of-bounds error. For example, running the following commands in a Linux environment with debugging enabled may reproduce the issue and reveal the vulnerability: 1. Open a terminal with root privileges. 2. Run: echo -n '1' > /sys/kernel/debug/tracing/osnoise/cpus If the system logs show a KASAN slab-out-of-bounds error referencing _parse_integer_limit, the vulnerability is present. Monitoring kernel logs (e.g., using dmesg) after this operation can help detect the issue.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves ensuring that any writes to /sys/kernel/debug/tracing/osnoise/cpus properly null-terminate the input buffer to prevent the slab-out-of-bounds error. Applying the patch that fixes the osnoise_cpus_write() function to add a '\0' terminator to the buffer is necessary. Until the patch is applied, avoid writing to /sys/kernel/debug/tracing/osnoise/cpus or restrict access to this interface to trusted users only.