CVE-2025-39689

The vulnerability exists in the Linux kernel's ftrace subsystem. When reading the set_ftrace_filter or set_ftrace_notrace files, the reader used a pointer directly to the global tracer hash without making a local copy. This pointer remained static across function calls that release locks, allowing the hash to be modified concurrently and causing a use-after-free bug.

Exploitation requires local access to the ftrace files and the ability to trigger a race condition where the filter hash is updated while another thread reads the file. This can be achieved by a local attacker with sufficient privileges to access these files and perform concurrent modifications.

A successful exploit can lead to memory corruption, potentially resulting in privilege escalation or a system crash. The vulnerability has been assigned a CVSS score of 7.8 (High).

The fix allocates and copies the hash for reading, similar to the writer's approach, thereby preventing the use-after-free. Patches are available from the Linux kernel stable repository.