Medium severity · published Sep 16, 2025
CVE-2025-39813
ftrace: Fix potential warning in trace_printk_seq during ftrace_dump
4.7
CVSS
0.1%
EPSS
No
On KEV
Description
In the Linux kernel, the following vulnerability has been resolved:
ftrace: Fix potential warning in trace_printk_seq during ftrace_dump
When calling ftrace_dump_one() concurrently with reading trace_pipe,
a WARN_ON_ONCE() in trace_printk_seq() can be triggered due to a race
condition.
The issue occurs because:
CPU0 (ftrace_dump) CPU1 (reader)
echo z > /proc/sysrq-trigger
!trace_empty(&iter)
trace_iterator_reset(&iter) <- len = size = 0
cat /sys/kernel/tracing/trace_pipe
trace_find_next_entry_inc(&iter)
__find_next_entry
ring_buffer_empty_cpu <- all empty
return NULL
trace_printk_seq(&iter.seq)
WARN_ON_ONCE(s->seq.len >= s->seq.size)
In the context between trace_empty() and trace_find_next_entry_inc()
during ftrace_dump, the ring buffer data was consumed by other readers.
This caused trace_find_next_entry_inc to return NULL, failing to populate
`iter.seq`. At this point, due to the prior trace_iterator_reset, both
`iter.seq.len` and `iter.seq.size` were set to 0. Since they are equal,
the WARN_ON_ONCE condition is triggered.
Move the trace_printk_seq() into the if block that checks to make sure the
return value of trace_find_next_entry_inc() is non-NULL in
ftrace_dump_one(), ensuring the 'iter.seq' is properly populated before
subsequent operations.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Local
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 2% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KE
Kernel · Linux
2.6.28 before 5.4.298; 5.5 before 5.10.242; 5.11 before 5.15.191; 5.16 before 6.1.150; 6.2 before 6.6.104; 6.7 before 6.12.45; +3 more · source: NVD
LI
Linux · Linux
d769041f865330034131525ee6a7f72eb4af2a24 before f299353e7ccbcc5c2ed8993c48fbe7609cbe729a; d769041f865330034131525ee6a7f72eb4af2a24 before 5ab0ec206deb99eb3baf8f1d7602aeaa91dbcc85; d769041f865330034131525ee6a7f72eb4af2a24 before a6f0f8873cc30fd4543b09adf03f7f51d293f0e6; d769041f865330034131525ee6a7f72eb4af2a24 before e80ff23ba8bdb0f41a1afe2657078e4097d13a9a; d769041f865330034131525ee6a7f72eb4af2a24 before 28c8fb7ae2ad27d81c8de3c4fe608c509f6a18aa; d769041f865330034131525ee6a7f72eb4af2a24 before ced94e137e6cd5e79c65564841d3b7695d0f5fa3; +3 more · source: vendor
DL
Debian Linux · Debian
11.0 · source: NVD
SC
SIMATIC CN 4100 · Siemens
before V5.0 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-39813
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-39813
Patch
https://git.kernel.org/stable/c/28c8fb7ae2ad27d81c8de3c4fe608c509f6a18aa
Patch
https://git.kernel.org/stable/c/4013aef2ced9b756a410f50d12df9ebe6a883e4a
Patch
https://git.kernel.org/stable/c/5ab0ec206deb99eb3baf8f1d7602aeaa91dbcc85
Patch
https://git.kernel.org/stable/c/a6f0f8873cc30fd4543b09adf03f7f51d293f0e6
Patch
https://git.kernel.org/stable/c/ced94e137e6cd5e79c65564841d3b7695d0f5fa3
Patch
https://git.kernel.org/stable/c/e80ff23ba8bdb0f41a1afe2657078e4097d13a9a
More from Kernel
9.8
CVE-2025-39682
tls: fix handling of zero-length records on the rx_list
8.8
CVE-2026-53266
netfilter: bridge: make ebt_snat ARP rewrite writable
8.8
CVE-2013-6282
Linux Kernel Improper Input Validation Vulnerability
8.4
CVE-2022-0185
Linux Kernel Heap-Based Buffer Overflow Vulnerability
8.4
CVE-2013-2094
Linux Kernel Privilege Escalation Vulnerability
