{"id":"CVE-2025-21899","revision":null,"records":[{"revision":"69dec7d1046e479ba0e5cc243985e5f0","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-21899","aliases":[],"title":"tracing: Fix bad hist from corrupting named_triggers list","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Fix bad hist from corrupting named_triggers list\n\nThe following commands causes a crash:\n\n ~# cd /sys/kernel/tracing/events/rcu/rcu_callback\n ~# echo 'hist:name=bad:keys=common_pid:onmax(bogus).save(common_pid)' > trigger\n bash: echo: write error: Invalid argument\n ~# echo 'hist:name=bad:keys=common_pid' > trigger\n\nBecause the following occurs:\n\nevent_trigger_write() {\n  trigger_process_regex() {\n    event_hist_trigger_parse() {\n\n      data = event_trigger_alloc(..);\n\n      event_trigger_register(.., data) {\n        cmd_ops->reg(.., data, ..) [hist_register_trigger()] {\n          data->ops->init() [event_hist_trigger_init()] {\n            save_named_trigger(name, data) {\n              list_add(&data->named_list, &named_triggers);\n            }\n          }\n        }\n      }\n\n      ret = create_actions(); (return -EINVAL)\n      if (ret)\n        goto out_unreg;\n[..]\n      ret = hist_trigger_enable(data, ...) {\n        list_add_tail_rcu(&data->list, &file->triggers); <<<---- SKIPPED!!! (this is important!)\n[..]\n out_unreg:\n      event_hist_unregister(.., data) {\n        cmd_ops->unreg(.., data, ..) [hist_unregister_trigger()] {\n          list_for_each_entry(iter, &file->triggers, list) {\n            if (!hist_trigger_match(data, iter, named_data, false))   <- never matches\n                continue;\n            [..]\n            test = iter;\n          }\n          if (test && test->ops->free) <<<-- test is NULL\n\n            test->ops->free(test) [event_hist_trigger_free()] {\n              [..]\n              if (data->name)\n                del_named_trigger(data) {\n                  list_del(&data->named_list);  <<<<-- NEVER gets removed!\n                }\n              }\n           }\n         }\n\n         [..]\n         kfree(data); <<<-- frees item but it is still on list\n\nThe next time a hist with name is registered, it causes an u-a-f bug and\nthe kernel can crash.\n\nMove the code around such that if event_trigger_register() succeeds, the\nnext thing called is hist_trigger_enable() which adds it to the list.\n\nA bunch of actions is called if get_named_trigger_data() returns false.\nBut that doesn't need to be called after event_trigger_register(), so it\ncan be moved up, allowing event_trigger_register() to be called just\nbefore hist_trigger_enable() keeping them together and allowing the\nfile->triggers to be properly populated.","state":0,"publishedAt":"2025-04-01T15:26:50.791+00:00","modifiedAt":"2026-10-15T21:51:55.265+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"kernel/trace/trace_events_hist.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"067fe038e70f6e64960d26a79c4df5f1413d0f13\",\n                            \"lessThan\": \"5ae1b18f05ee2b849dc03b6c15d7da0c1c6efa77\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"067fe038e70f6e64960d26a79c4df5f1413d0f13\",\n                            \"lessThan\": \"43b254d46c740bf9dbe65709afa021dd726dfa99\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"067fe038e70f6e64960d26a79c4df5f1413d0f13\",\n                            \"lessThan\": \"435d2964af815aae456db554c62963b4515f19d0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"067fe038e70f6e64960d26a79c4df5f1413d0f13\",\n                            \"lessThan\": \"f1ae50cfb818ce1ac7a674406dfadb7653e2552d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"067fe038e70f6e64960d26a79c4df5f1413d0f13\",\n                            \"lessThan\": \"6f86bdeab633a56d5c6dccf1a2c5989b6a5e323e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"kernel/trace/trace_events_hist.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"4.17\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"4.17\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.130\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.81\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.18\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.13.6\",\n                            \"lessThanOrEqual\": \"6.13.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.14\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/5ae1b18f05ee2b849dc03b6c15d7da0c1c6efa77","https://git.kernel.org/stable/c/43b254d46c740bf9dbe65709afa021dd726dfa99","https://git.kernel.org/stable/c/435d2964af815aae456db554c62963b4515f19d0","https://git.kernel.org/stable/c/f1ae50cfb818ce1ac7a674406dfadb7653e2552d","https://git.kernel.org/stable/c/6f86bdeab633a56d5c6dccf1a2c5989b6a5e323e"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-21899","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-21899","identifiers":["CVE-2025-21899"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-09T13:04:36.1502744+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-09T13:04:36.1502744+00:00","lastSuccessAt":"2026-11-09T13:04:36.3089681+00:00","error":null,"lastVerifiedAt":"2026-11-09T13:04:36.3089715+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-24e6fde7b744113daefb8f6135035fb8a5c69c9617c9c0d40574a0376532ffd3-bce548cb9713389d6cc2da20d64478978e569c118d9e3817d5449036d2c96da4","complete":true,"records":421424,"lastAttemptAt":"2026-11-09T13:02:24.4919458+00:00","lastSuccessAt":"2026-11-09T13:02:24.4462956+00:00","error":null,"lastVerifiedAt":"2026-11-09T13:02:24.4919458+00:00","snapshotPublishedAt":"2026-11-09T12:31:22+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-897f1f8852214f7d97a85b009edb7d92","complete":false,"records":13655,"lastAttemptAt":"2026-11-09T13:16:47.5163098+00:00","lastSuccessAt":"2026-11-09T13:16:47.505+00:00","error":"7 identifier lookups failed; latest failures include HTTP 403. Other identifiers were checked independently.","lastVerifiedAt":"2026-11-09T13:16:47.505+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13700,"expectedIdentifiers":13707,"failedIdentifiers":7},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-09T13:04:36.1502744+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-09T13:04:36.1502744+00:00","lastSuccessAt":"2026-11-09T13:04:36.3096956+00:00","error":null,"lastVerifiedAt":"2026-11-09T13:04:36.3096959+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-fec5a400f2004099a6ceb2e015ba7713","complete":true,"records":13667,"lastAttemptAt":"2026-11-09T13:04:37.3410735+00:00","lastSuccessAt":"2026-11-09T13:04:37.338+00:00","error":null,"lastVerifiedAt":"2026-11-09T13:04:37.338+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13707,"expectedIdentifiers":13707,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-980593e6977a6d1b4fb1eed5a1ffe88a468736f89f0a06f710924ad59132c023","complete":true,"records":9914,"lastAttemptAt":"2026-11-09T13:04:36.0102403+00:00","lastSuccessAt":"2026-11-08T11:07:07.068788+00:00","error":null,"lastVerifiedAt":"2026-11-09T13:04:36.0102403+00:00","snapshotPublishedAt":"2026-11-08T11:02:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-09T13:02:24.6845928+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-09T13:02:24.6845928+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-c905fa1bd26c7b261e77cc7202a86dc766ff31c2b096b501f3bf44f561e34970","complete":true,"records":3063,"lastAttemptAt":"2026-11-09T13:04:36.1177843+00:00","lastSuccessAt":"2026-11-09T12:02:21.7931207+00:00","error":null,"lastVerifiedAt":"2026-11-09T13:04:36.1177843+00:00","snapshotPublishedAt":"2026-11-09T11:18:00+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-3e30324623f4d042faeccbd22ff1ab0b99d8d436d702bf285b288cefe802b265","complete":true,"records":231298,"lastAttemptAt":"2026-11-09T13:04:35.8866798+00:00","lastSuccessAt":"2026-11-09T13:04:34.5744206+00:00","error":null,"lastVerifiedAt":"2026-11-09T13:04:35.8866798+00:00","snapshotPublishedAt":"2026-11-09T12:33:12+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}