GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-37845 (GCVE-0-2025-37845)

Vulnerability from cvelistv5 – Published: 2025-05-09 06:41 – Updated: 2026-08-05 11:57
VLAI
Title
tracing: fprobe events: Fix possible UAF on modules
Summary
In the Linux kernel, the following vulnerability has been resolved: tracing: fprobe events: Fix possible UAF on modules Commit ac91052f0ae5 ("tracing: tprobe-events: Fix leakage of module refcount") moved try_module_get() from __find_tracepoint_module_cb() to find_tracepoint() caller, but that introduced a possible UAF because the module can be unloaded before try_module_get(). In this case, the module object should be freed too. Thus, try_module_get() does not only fail but may access to the freed object. To avoid that, try_module_get() in __find_tracepoint_module_cb() again.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 71c9cf87776eaa556fc0a0a060df94200e1f521c , < 868df4eb784c3ccc7e4340a9ea993cbbedca167e (git)
Affected: 9db2b8cf4ea07b579db588e0353d5680f5d1f071 , < a27d2de2472b1cc7d582ab405d1d5832a80481de (git)
Affected: ac91052f0ae5be9e46211ba92cc31c0e3b0a933a , < 626f01f4d26e8cf92e69c1df53036153c8e98a20 (git)
Affected: ac91052f0ae5be9e46211ba92cc31c0e3b0a933a , < dd941507a9486252d6fcf11814387666792020f3 (git)
Affected: 6.12.21 , < 6.12.24 (semver)
Affected: 6.13.9 , < 6.13.12 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.14
Unaffected: 0 , < 6.14 (semver)
Unaffected: 6.12.24 , ≤ 6.12.* (semver)
Unaffected: 6.13.12 , ≤ 6.13.* (semver)
Unaffected: 6.14.3 , ≤ 6.14.* (semver)
Unaffected: 6.15 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/trace_fprobe.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "868df4eb784c3ccc7e4340a9ea993cbbedca167e",
              "status": "affected",
              "version": "71c9cf87776eaa556fc0a0a060df94200e1f521c",
              "versionType": "git"
            },
            {
              "lessThan": "a27d2de2472b1cc7d582ab405d1d5832a80481de",
              "status": "affected",
              "version": "9db2b8cf4ea07b579db588e0353d5680f5d1f071",
              "versionType": "git"
            },
            {
              "lessThan": "626f01f4d26e8cf92e69c1df53036153c8e98a20",
              "status": "affected",
              "version": "ac91052f0ae5be9e46211ba92cc31c0e3b0a933a",
              "versionType": "git"
            },
            {
              "lessThan": "dd941507a9486252d6fcf11814387666792020f3",
              "status": "affected",
              "version": "ac91052f0ae5be9e46211ba92cc31c0e3b0a933a",
              "versionType": "git"
            },
            {
              "lessThan": "6.12.24",
              "status": "affected",
              "version": "6.12.21",
              "versionType": "semver"
            },
            {
              "lessThan": "6.13.12",
              "status": "affected",
              "version": "6.13.9",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/trace_fprobe.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.24",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.24",
                  "versionStartIncluding": "6.12.21",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.12",
                  "versionStartIncluding": "6.13.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.3",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: fprobe events: Fix possible UAF on modules\n\nCommit ac91052f0ae5 (\"tracing: tprobe-events: Fix leakage of module\nrefcount\") moved try_module_get() from __find_tracepoint_module_cb()\nto find_tracepoint() caller, but that introduced a possible UAF\nbecause the module can be unloaded before try_module_get(). In this\ncase, the module object should be freed too. Thus, try_module_get()\ndoes not only fail but may access to the freed object.\n\nTo avoid that, try_module_get() in __find_tracepoint_module_cb()\nagain."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached only by writing a tracepoint probe definition to the tracefs `dynamic_events` file (`trace_fprobe_create()` \u2192 `find_tracepoint()`), which requires local access to the machine. There is no network-facing consumer of this code.\nAC:L - The attacker drives both sides of the race \u2014 repeatedly issuing `t:` tprobe creations while causing module load/unload churn \u2014 and the operation can be retried indefinitely at no cost until the window between `mutex_unlock()` in `for_each_module_tracepoint()` and `try_module_get()` is hit. `CONFIG_FPROBE_EVENTS` is `default y`, so no rare configuration is required.\nPR:L - Exploitation needs write access to the tracefs `dynamic_events` interface, which is routinely delegated to non-root tracing/debug accounts and groups (Android shell/system, ChromeOS debugd, perf/tracing groups, container debug sidecars) rather than being an exclusively root-only capability. No credential check exists in the code path itself beyond file permissions.\nUI:N - The attacker performs the tracefs write and the concurrent module operations entirely on their own; no victim action or interaction is needed.\nS:U - The use-after-free corrupts kernel memory within the same security authority as the kernel itself; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The stale `struct module` and the stale tracepoint structure are read after being freed, and if the freed region is reclaimed by attacker-sprayed allocations the resulting values (`probestub` address, funcname resolved via `kallsyms_lookup()`) feed back into observable state, giving a path to kernel memory disclosure.\nI:H - `try_module_get()` performs an atomic increment into freed memory, and a \"successful\" get lets the code register a tracepoint probe and an ftrace hook using function pointers read out of freed, reclaimable memory \u2014 a write plus control-flow-hijack primitive.\nA:H - Touching the freed module allocation (vmalloc-backed, so frequently unmapped on free) produces an immediate oops or panic, and the subsequent probe registration on freed tracepoint data reliably destabilizes the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:57:48.902Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/868df4eb784c3ccc7e4340a9ea993cbbedca167e"
        },
        {
          "url": "https://git.kernel.org/stable/c/a27d2de2472b1cc7d582ab405d1d5832a80481de"
        },
        {
          "url": "https://git.kernel.org/stable/c/626f01f4d26e8cf92e69c1df53036153c8e98a20"
        },
        {
          "url": "https://git.kernel.org/stable/c/dd941507a9486252d6fcf11814387666792020f3"
        }
      ],
      "title": "tracing: fprobe events: Fix possible UAF on modules",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-37845",
    "datePublished": "2025-05-09T06:41:54.022Z",
    "dateReserved": "2025-04-16T04:51:23.953Z",
    "dateUpdated": "2026-08-05T11:57:48.902Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-37845",
      "date": "2026-09-16",
      "epss": "0.00259",
      "percentile": "0.17709"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-37845\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-05-09T07:16:05.307\",\"lastModified\":\"2026-07-30T06:22:23.390\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntracing: fprobe events: Fix possible UAF on modules\\n\\nCommit ac91052f0ae5 (\\\"tracing: tprobe-events: Fix leakage of module\\nrefcount\\\") moved try_module_get() from __find_tracepoint_module_cb()\\nto find_tracepoint() caller, but that introduced a possible UAF\\nbecause the module can be unloaded before try_module_get(). In this\\ncase, the module object should be freed too. Thus, try_module_get()\\ndoes not only fail but may access to the freed object.\\n\\nTo avoid that, try_module_get() in __find_tracepoint_module_cb()\\nagain.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: tracing: fprobe events: Fix possible UAF on modules. La confirmaci\u00f3n ac91052f0ae5 (\\\"tracing: tprobe-events: Fix leakage of module refcount\\\") traslad\u00f3 try_module_get() de __find_tracepoint_module_cb() al llamador de find_tracepoint(), pero esto introdujo un posible UAF porque el m\u00f3dulo puede descargarse antes que try_module_get(). En este caso, el objeto del m\u00f3dulo tambi\u00e9n deber\u00eda liberarse. Por lo tanto, try_module_get() no solo falla, sino que puede acceder al objeto liberado. Para evitarlo, vuelva a intentar try_module_get() en __find_tracepoint_module_cb().\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"kernel/trace/trace_fprobe.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"71c9cf87776eaa556fc0a0a060df94200e1f521c\",\"lessThan\":\"868df4eb784c3ccc7e4340a9ea993cbbedca167e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9db2b8cf4ea07b579db588e0353d5680f5d1f071\",\"lessThan\":\"a27d2de2472b1cc7d582ab405d1d5832a80481de\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ac91052f0ae5be9e46211ba92cc31c0e3b0a933a\",\"lessThan\":\"626f01f4d26e8cf92e69c1df53036153c8e98a20\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ac91052f0ae5be9e46211ba92cc31c0e3b0a933a\",\"lessThan\":\"dd941507a9486252d6fcf11814387666792020f3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6.12.21\",\"lessThan\":\"6.12.24\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.13.9\",\"lessThan\":\"6.13.12\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"kernel/trace/trace_fprobe.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.14\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.14\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.24\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13.12\",\"lessThanOrEqual\":\"6.13.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.14.3\",\"lessThanOrEqual\":\"6.14.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.12.21\",\"versionEndExcluding\":\"6.12.24\",\"matchCriteriaId\":\"7AD01D25-A815-4E20-8715-FB2B50EE7FC2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13.9\",\"versionEndExcluding\":\"6.13.12\",\"matchCriteriaId\":\"A992E5FB-2832-43F3-BCBF-5AE81D7E5BD7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.14.1\",\"versionEndExcluding\":\"6.14.3\",\"matchCriteriaId\":\"4E7F0901-3C1F-4954-B0AB-4531CB0C37DD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"7DE421BA-0600-4401-A175-73CAB6A6FB4E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"8D465631-2980-487A-8E65-40AE2B9F8ED1\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/626f01f4d26e8cf92e69c1df53036153c8e98a20\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/868df4eb784c3ccc7e4340a9ea993cbbedca167e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a27d2de2472b1cc7d582ab405d1d5832a80481de\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/dd941507a9486252d6fcf11814387666792020f3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T09:32:31+00:00",
      "cve": "CVE-2025-37845",
      "id": "CVE-2025-37845",
      "initial_release_date": "2025-05-09T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: tracing: fprobe events: Fix possible UAF on modules",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-37845.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.