CVE-2025-39683

Vulnerability

Analysis

The vulnerability resides in the Linux kernel's tracing subsystem, specifically in the handling of user input to the set_ftrace_filter file. When a user writes a string longer than FTRACE_BUFF_MAX, the function trace_get_user fails but does not null-terminate the parser->buffer. This leaves the buffer in an inconsistent state, and subsequent processing in ftrace_regex_release via ftrace_process_regex and strsep triggers a slab-out-of-bounds read, as evidenced by the KASAN report.

Exploitation

An attacker with local access and the ability to write to the set_ftrace_filter file can trigger this vulnerability. No special privileges beyond the ability to interact with the tracing interface are required, though typically such access is restricted to root or users in the tracing group. The attack surface is limited to systems where the tracing subsystem is enabled and accessible.

Impact

The out-of-bounds read can cause a kernel crash or denial of service, as indicated by the KASAN alarm. The vulnerability does not appear to allow arbitrary code execution or privilege escalation based on the available information.

Mitigation

The fix is included in Linux kernel stable commits [3][4]. Users should apply the latest kernel updates from their distribution or compile a patched kernel. No workaround is documented.