Medium severity · published Sep 16, 2025
CVE-2025-39813
ftrace: Fix potential warning in trace_printk_seq during ftrace_dump
4.7
CVSS
0.1%
EPSS
No
On KEV
Description
In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix potential warning in trace_printk_seq during ftrace_dump When calling ftrace_dump_one() concurrently with reading trace_pipe, a WARN_ON_ONCE() in trace_printk_seq() can be triggered due to a race condition. The issue occurs because: CPU0 (ftrace_dump) CPU1 (reader) echo z > /proc/sysrq-trigger !trace_empty(&iter) trace_iterator_reset(&iter) <- len = size = 0 cat /sys/kernel/tracing/trace_pipe trace_find_next_entry_inc(&iter) __find_next_entry ring_buffer_empty_cpu <- all empty return NULL trace_printk_seq(&iter.seq) WARN_ON_ONCE(s->seq.len >= s->seq.size) In the context between trace_empty() and trace_find_next_entry_inc() during ftrace_dump, the ring buffer data was consumed by other readers. This caused trace_find_next_entry_inc to return NULL, failing to populate `iter.seq`. At this point, due to the prior trace_iterator_reset, both `iter.seq.len` and `iter.seq.size` were set to 0. Since they are equal, the WARN_ON_ONCE condition is triggered. Move the trace_printk_seq() into the if block that checks to make sure the return value of trace_find_next_entry_inc() is non-NULL in ftrace_dump_one(), ensuring the 'iter.seq' is properly populated before subsequent operations.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Local
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 2% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KE
Kernel · Linux
2.6.28 before 5.4.298; 5.5 before 5.10.242; 5.11 before 5.15.191; 5.16 before 6.1.150; 6.2 before 6.6.104; 6.7 before 6.12.45; +3 more · source: NVD
LI
Linux · Linux
d769041f865330034131525ee6a7f72eb4af2a24 before f299353e7ccbcc5c2ed8993c48fbe7609cbe729a; d769041f865330034131525ee6a7f72eb4af2a24 before 5ab0ec206deb99eb3baf8f1d7602aeaa91dbcc85; d769041f865330034131525ee6a7f72eb4af2a24 before a6f0f8873cc30fd4543b09adf03f7f51d293f0e6; d769041f865330034131525ee6a7f72eb4af2a24 before e80ff23ba8bdb0f41a1afe2657078e4097d13a9a; d769041f865330034131525ee6a7f72eb4af2a24 before 28c8fb7ae2ad27d81c8de3c4fe608c509f6a18aa; d769041f865330034131525ee6a7f72eb4af2a24 before ced94e137e6cd5e79c65564841d3b7695d0f5fa3; +3 more · source: vendor
DL
Debian Linux · Debian
11.0 · source: NVD
SC
SIMATIC CN 4100 · Siemens
before V5.0 · source: CISA