{"id":"CVE-2025-39689","revision":"a2cb4daac3c84ac5ac28f77875dc89d4","records":[{"revision":"a2cb4daac3c84ac5ac28f77875dc89d4","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-39689","aliases":[],"title":"ftrace: Also allocate and copy hash for reading of filter files","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nftrace: Also allocate and copy hash for reading of filter files\n\nCurrently the reader of set_ftrace_filter and set_ftrace_notrace just adds\nthe pointer to the global tracer hash to its iterator. Unlike the writer\nthat allocates a copy of the hash, the reader keeps the pointer to the\nfilter hashes. This is problematic because this pointer is static across\nfunction calls that release the locks that can update the global tracer\nhashes. This can cause UAF and similar bugs.\n\nAllocate and copy the hash for reading the filter files like it is done\nfor the writers. This not only fixes UAF bugs, but also makes the code a\nbit simpler as it doesn't have to differentiate when to free the\niterator's hash between writers and readers.","state":0,"publishedAt":"2025-09-05T17:20:55.27+00:00","modifiedAt":"2026-10-15T22:02:30.348+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"kernel/trace/ftrace.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"c20489dad156dd9919ebd854bbace46dbd2576a3\",\n                            \"lessThan\": \"12064e1880fc9202be75ff668205b1703d92f74f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"c20489dad156dd9919ebd854bbace46dbd2576a3\",\n                            \"lessThan\": \"c4cd93811e038d19f961985735ef7bb128078dfb\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"c20489dad156dd9919ebd854bbace46dbd2576a3\",\n                            \"lessThan\": \"e0b6b223167e1edde5c82edf38e393c06eda1f13\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"c20489dad156dd9919ebd854bbace46dbd2576a3\",\n                            \"lessThan\": \"a40c69f4f1ed96acbcd62e9b5ff3a596f0a91309\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"c20489dad156dd9919ebd854bbace46dbd2576a3\",\n                            \"lessThan\": \"3b114a3282ab1a12cb4618a8f45db5d7185e784a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"c20489dad156dd9919ebd854bbace46dbd2576a3\",\n                            \"lessThan\": \"c591ba1acd081d4980713e47869dd1cc3d963d19\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"c20489dad156dd9919ebd854bbace46dbd2576a3\",\n                            \"lessThan\": \"64db338140d2bad99a0a8c6a118dd60b3e1fb8cb\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"c20489dad156dd9919ebd854bbace46dbd2576a3\",\n                            \"lessThan\": \"bfb336cf97df7b37b2b2edec0f69773e06d11955\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"kernel/trace/ftrace.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"4.12\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"4.12\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.4.297\",\n                            \"lessThanOrEqual\": \"5.4.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.241\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.190\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.149\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.103\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.44\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.16.4\",\n                            \"lessThanOrEqual\": \"6.16.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.17\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/12064e1880fc9202be75ff668205b1703d92f74f","https://git.kernel.org/stable/c/c4cd93811e038d19f961985735ef7bb128078dfb","https://git.kernel.org/stable/c/e0b6b223167e1edde5c82edf38e393c06eda1f13","https://git.kernel.org/stable/c/a40c69f4f1ed96acbcd62e9b5ff3a596f0a91309","https://git.kernel.org/stable/c/3b114a3282ab1a12cb4618a8f45db5d7185e784a","https://git.kernel.org/stable/c/c591ba1acd081d4980713e47869dd1cc3d963d19","https://git.kernel.org/stable/c/64db338140d2bad99a0a8c6a118dd60b3e1fb8cb","https://git.kernel.org/stable/c/bfb336cf97df7b37b2b2edec0f69773e06d11955"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-39689","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-39689","identifiers":["CVE-2025-39689"]},"retained":false,"historicalAffected":[]}],"coverage":[]}