{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-38346", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:24.006Z", "datePublished": "2025-07-10T08:15:14.290Z", "dateUpdated": "2026-08-05T12:01:17.019Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:01:17.019Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nftrace: Fix UAF when lookup kallsym after ftrace disabled\n\nThe following issue happens with a buggy module:\n\nBUG: unable to handle page fault for address: ffffffffc05d0218\nPGD 1bd66f067 P4D 1bd66f067 PUD 1bd671067 PMD 101808067 PTE 0\nOops: Oops: 0000 [#1] SMP KASAN PTI\nTainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS\nRIP: 0010:sized_strscpy+0x81/0x2f0\nRSP: 0018:ffff88812d76fa08 EFLAGS: 00010246\nRAX: 0000000000000000 RBX: ffffffffc0601010 RCX: dffffc0000000000\nRDX: 0000000000000038 RSI: dffffc0000000000 RDI: ffff88812608da2d\nRBP: 8080808080808080 R08: ffff88812608da2d R09: ffff88812608da68\nR10: ffff88812608d82d R11: ffff88812608d810 R12: 0000000000000038\nR13: ffff88812608da2d R14: ffffffffc05d0218 R15: fefefefefefefeff\nFS: 00007fef552de740(0000) GS:ffff8884251c7000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: ffffffffc05d0218 CR3: 00000001146f0000 CR4: 00000000000006f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \n ftrace_mod_get_kallsym+0x1ac/0x590\n update_iter_mod+0x239/0x5b0\n s_next+0x5b/0xa0\n seq_read_iter+0x8c9/0x1070\n seq_read+0x249/0x3b0\n proc_reg_read+0x1b0/0x280\n vfs_read+0x17f/0x920\n ksys_read+0xf3/0x1c0\n do_syscall_64+0x5f/0x2e0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nThe above issue may happen as follows:\n(1) Add kprobe tracepoint;\n(2) insmod test.ko;\n(3) Module triggers ftrace disabled;\n(4) rmmod test.ko;\n(5) cat /proc/kallsyms; --> Will trigger UAF as test.ko already removed;\nftrace_mod_get_kallsym()\n...\nstrscpy(module_name, mod_map->mod->name, MODULE_NAME_LEN);\n...\n\nThe problem is when a module triggers an issue with ftrace and\nsets ftrace_disable. The ftrace_disable is set when an anomaly is\ndiscovered and to prevent any more damage, ftrace stops all text\nmodification. The issue that happened was that the ftrace_disable stops\nmore than just the text modification.\n\nWhen a module is loaded, its init functions can also be traced. Because\nkallsyms deletes the init functions after a module has loaded, ftrace\nsaves them when the module is loaded and function tracing is enabled. This\nallows the output of the function trace to show the init function names\ninstead of just their raw memory addresses.\n\nWhen a module is removed, ftrace_release_mod() is called, and if\nftrace_disable is set, it just returns without doing anything more. The\nproblem here is that it leaves the mod_list still around and if kallsyms\nis called, it will call into this code and access the module memory that\nhas already been freed as it will return:\n\n strscpy(module_name, mod_map->mod->name, MODULE_NAME_LEN);\n\nWhere the \"mod\" no longer exists and triggers a UAF bug." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The dangling dereference is reached through a `read(2)` on the local `/proc/kallsyms` file, and the state is established by local module load/unload; no network or remote-peer data reaches `ftrace_mod_get_kallsym()`.\nAC:L - Scoring the vulnerable configuration (a tracer registered when the module's init text was freed, `ftrace_disabled` latched by an ftrace anomaly, module then unloaded), the stale `ftrace_mod_map` persists indefinitely and the dereference is fully deterministic — no race, no memory-layout luck, and every subsequent `/proc/kallsyms` read re-triggers it at will.\nPR:L - `/proc/kallsyms` is created mode 0444 and the module-name column is emitted regardless of `kptr_restrict`, so any unprivileged local user reaches `strscpy(module_name, mod_map->mod->name, ...)` with a plain `cat`, exactly as in the reported oops from `ksys_read`.\nUI:N - The attacker's own read of `/proc/kallsyms` performs the dereference; no separate victim has to open a file, mount anything, or take any action.\nS:U - Both the freed module memory and the faulting code are kernel-internal, within the same security authority the attacker is already attacking; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - `strscpy()` reads from `mod_map->mod->name` inside the freed module allocation and the result is printed straight to userspace, so once the execmem/vmalloc range is reclaimed the attacker harvests reclaimed kernel memory; `ftrace_mod_address_lookup()` also returns that dangling pointer to `kallsyms_lookup()`/`sprint_symbol()`, which copy it with no length bound and can over-read well past the object.\nI:H - A stale `struct module *` is dereferenced after its backing allocation has been returned to the module/vmalloc allocator, so reclaiming that allocation makes the kernel interpret attacker-influenced content as live module metadata — the standard use-after-free corruption primitive.\nA:H - In the common case the module range is unmapped and the access faults on a non-present kernel address, oopsing in `sized_strscpy()` as in the reported trace; because the leaked `mod_map` is never freed, any unprivileged user can panic the machine repeatedly." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "kernel/trace/ftrace.c" ], "versions": [ { "version": "aba4b5c22cbac296f4081a0476d0c55828f135b4", "lessThan": "d064c68781c19f378af1ae741d9132d35d24b2bb", "status": "affected", "versionType": "git" }, { "version": "aba4b5c22cbac296f4081a0476d0c55828f135b4", "lessThan": "8690cd3258455bbae64f809e1d3ee0f043661c71", "status": "affected", "versionType": "git" }, { "version": "aba4b5c22cbac296f4081a0476d0c55828f135b4", "lessThan": "6805582abb720681dd1c87ff677f155dcf4e86c9", "status": "affected", "versionType": "git" }, { "version": "aba4b5c22cbac296f4081a0476d0c55828f135b4", "lessThan": "03a162933c4a03b9f1a84f7d8482903c7e1e11bb", "status": "affected", "versionType": "git" }, { "version": "aba4b5c22cbac296f4081a0476d0c55828f135b4", "lessThan": "83a692a9792aa86249d68a8ac0b9d55ecdd255fa", "status": "affected", "versionType": "git" }, { "version": "aba4b5c22cbac296f4081a0476d0c55828f135b4", "lessThan": "8e89c17dc8970c5f71a3a991f5724d4c8de42d8c", "status": "affected", "versionType": "git" }, { "version": "aba4b5c22cbac296f4081a0476d0c55828f135b4", "lessThan": "f78a786ad9a5443a29eef4dae60cde85b7375129", "status": "affected", "versionType": "git" }, { "version": "aba4b5c22cbac296f4081a0476d0c55828f135b4", "lessThan": "f914b52c379c12288b7623bb814d0508dbe7481d", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "kernel/trace/ftrace.c" ], "versions": [ { "version": "4.15", "status": "affected" }, { "version": "0", "lessThan": "4.15", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.295", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.239", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.186", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.142", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.95", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.35", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.15.4", "lessThanOrEqual": "6.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.16", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "5.4.295" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "5.10.239" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "5.15.186" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "6.1.142" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "6.6.95" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "6.12.35" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "6.15.4" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "6.16" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/d064c68781c19f378af1ae741d9132d35d24b2bb" }, { "url": "https://git.kernel.org/stable/c/8690cd3258455bbae64f809e1d3ee0f043661c71" }, { "url": "https://git.kernel.org/stable/c/6805582abb720681dd1c87ff677f155dcf4e86c9" }, { "url": "https://git.kernel.org/stable/c/03a162933c4a03b9f1a84f7d8482903c7e1e11bb" }, { "url": "https://git.kernel.org/stable/c/83a692a9792aa86249d68a8ac0b9d55ecdd255fa" }, { "url": "https://git.kernel.org/stable/c/8e89c17dc8970c5f71a3a991f5724d4c8de42d8c" }, { "url": "https://git.kernel.org/stable/c/f78a786ad9a5443a29eef4dae60cde85b7375129" }, { "url": "https://git.kernel.org/stable/c/f914b52c379c12288b7623bb814d0508dbe7481d" } ], "title": "ftrace: Fix UAF when lookup kallsym after ftrace disabled", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T17:36:55.187Z" } } ] } }