GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-38346 (GCVE-0-2025-38346)

Vulnerability from cvelistv5 – Published: 2025-07-10 08:15 – Updated: 2026-08-05 12:01
VLAI
Title
ftrace: Fix UAF when lookup kallsym after ftrace disabled
Summary
In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix UAF when lookup kallsym after ftrace disabled The following issue happens with a buggy module: BUG: unable to handle page fault for address: ffffffffc05d0218 PGD 1bd66f067 P4D 1bd66f067 PUD 1bd671067 PMD 101808067 PTE 0 Oops: Oops: 0000 [#1] SMP KASAN PTI Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS RIP: 0010:sized_strscpy+0x81/0x2f0 RSP: 0018:ffff88812d76fa08 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffffffffc0601010 RCX: dffffc0000000000 RDX: 0000000000000038 RSI: dffffc0000000000 RDI: ffff88812608da2d RBP: 8080808080808080 R08: ffff88812608da2d R09: ffff88812608da68 R10: ffff88812608d82d R11: ffff88812608d810 R12: 0000000000000038 R13: ffff88812608da2d R14: ffffffffc05d0218 R15: fefefefefefefeff FS: 00007fef552de740(0000) GS:ffff8884251c7000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffc05d0218 CR3: 00000001146f0000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ftrace_mod_get_kallsym+0x1ac/0x590 update_iter_mod+0x239/0x5b0 s_next+0x5b/0xa0 seq_read_iter+0x8c9/0x1070 seq_read+0x249/0x3b0 proc_reg_read+0x1b0/0x280 vfs_read+0x17f/0x920 ksys_read+0xf3/0x1c0 do_syscall_64+0x5f/0x2e0 entry_SYSCALL_64_after_hwframe+0x76/0x7e The above issue may happen as follows: (1) Add kprobe tracepoint; (2) insmod test.ko; (3) Module triggers ftrace disabled; (4) rmmod test.ko; (5) cat /proc/kallsyms; --> Will trigger UAF as test.ko already removed; ftrace_mod_get_kallsym() ... strscpy(module_name, mod_map->mod->name, MODULE_NAME_LEN); ... The problem is when a module triggers an issue with ftrace and sets ftrace_disable. The ftrace_disable is set when an anomaly is discovered and to prevent any more damage, ftrace stops all text modification. The issue that happened was that the ftrace_disable stops more than just the text modification. When a module is loaded, its init functions can also be traced. Because kallsyms deletes the init functions after a module has loaded, ftrace saves them when the module is loaded and function tracing is enabled. This allows the output of the function trace to show the init function names instead of just their raw memory addresses. When a module is removed, ftrace_release_mod() is called, and if ftrace_disable is set, it just returns without doing anything more. The problem here is that it leaves the mod_list still around and if kallsyms is called, it will call into this code and access the module memory that has already been freed as it will return: strscpy(module_name, mod_map->mod->name, MODULE_NAME_LEN); Where the "mod" no longer exists and triggers a UAF bug.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: aba4b5c22cbac296f4081a0476d0c55828f135b4 , < d064c68781c19f378af1ae741d9132d35d24b2bb (git)
Affected: aba4b5c22cbac296f4081a0476d0c55828f135b4 , < 8690cd3258455bbae64f809e1d3ee0f043661c71 (git)
Affected: aba4b5c22cbac296f4081a0476d0c55828f135b4 , < 6805582abb720681dd1c87ff677f155dcf4e86c9 (git)
Affected: aba4b5c22cbac296f4081a0476d0c55828f135b4 , < 03a162933c4a03b9f1a84f7d8482903c7e1e11bb (git)
Affected: aba4b5c22cbac296f4081a0476d0c55828f135b4 , < 83a692a9792aa86249d68a8ac0b9d55ecdd255fa (git)
Affected: aba4b5c22cbac296f4081a0476d0c55828f135b4 , < 8e89c17dc8970c5f71a3a991f5724d4c8de42d8c (git)
Affected: aba4b5c22cbac296f4081a0476d0c55828f135b4 , < f78a786ad9a5443a29eef4dae60cde85b7375129 (git)
Affected: aba4b5c22cbac296f4081a0476d0c55828f135b4 , < f914b52c379c12288b7623bb814d0508dbe7481d (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.15
Unaffected: 0 , < 4.15 (semver)
Unaffected: 5.4.295 , ≤ 5.4.* (semver)
Unaffected: 5.10.239 , ≤ 5.10.* (semver)
Unaffected: 5.15.186 , ≤ 5.15.* (semver)
Unaffected: 6.1.142 , ≤ 6.1.* (semver)
Unaffected: 6.6.95 , ≤ 6.6.* (semver)
Unaffected: 6.12.35 , ≤ 6.12.* (semver)
Unaffected: 6.15.4 , ≤ 6.15.* (semver)
Unaffected: 6.16 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:36:55.187Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/ftrace.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d064c68781c19f378af1ae741d9132d35d24b2bb",
              "status": "affected",
              "version": "aba4b5c22cbac296f4081a0476d0c55828f135b4",
              "versionType": "git"
            },
            {
              "lessThan": "8690cd3258455bbae64f809e1d3ee0f043661c71",
              "status": "affected",
              "version": "aba4b5c22cbac296f4081a0476d0c55828f135b4",
              "versionType": "git"
            },
            {
              "lessThan": "6805582abb720681dd1c87ff677f155dcf4e86c9",
              "status": "affected",
              "version": "aba4b5c22cbac296f4081a0476d0c55828f135b4",
              "versionType": "git"
            },
            {
              "lessThan": "03a162933c4a03b9f1a84f7d8482903c7e1e11bb",
              "status": "affected",
              "version": "aba4b5c22cbac296f4081a0476d0c55828f135b4",
              "versionType": "git"
            },
            {
              "lessThan": "83a692a9792aa86249d68a8ac0b9d55ecdd255fa",
              "status": "affected",
              "version": "aba4b5c22cbac296f4081a0476d0c55828f135b4",
              "versionType": "git"
            },
            {
              "lessThan": "8e89c17dc8970c5f71a3a991f5724d4c8de42d8c",
              "status": "affected",
              "version": "aba4b5c22cbac296f4081a0476d0c55828f135b4",
              "versionType": "git"
            },
            {
              "lessThan": "f78a786ad9a5443a29eef4dae60cde85b7375129",
              "status": "affected",
              "version": "aba4b5c22cbac296f4081a0476d0c55828f135b4",
              "versionType": "git"
            },
            {
              "lessThan": "f914b52c379c12288b7623bb814d0508dbe7481d",
              "status": "affected",
              "version": "aba4b5c22cbac296f4081a0476d0c55828f135b4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/ftrace.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.15"
            },
            {
              "lessThan": "4.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.295",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.239",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.186",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.142",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.295",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.239",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.186",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.142",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.95",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.35",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.4",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nftrace: Fix UAF when lookup kallsym after ftrace disabled\n\nThe following issue happens with a buggy module:\n\nBUG: unable to handle page fault for address: ffffffffc05d0218\nPGD 1bd66f067 P4D 1bd66f067 PUD 1bd671067 PMD 101808067 PTE 0\nOops: Oops: 0000 [#1] SMP KASAN PTI\nTainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS\nRIP: 0010:sized_strscpy+0x81/0x2f0\nRSP: 0018:ffff88812d76fa08 EFLAGS: 00010246\nRAX: 0000000000000000 RBX: ffffffffc0601010 RCX: dffffc0000000000\nRDX: 0000000000000038 RSI: dffffc0000000000 RDI: ffff88812608da2d\nRBP: 8080808080808080 R08: ffff88812608da2d R09: ffff88812608da68\nR10: ffff88812608d82d R11: ffff88812608d810 R12: 0000000000000038\nR13: ffff88812608da2d R14: ffffffffc05d0218 R15: fefefefefefefeff\nFS:  00007fef552de740(0000) GS:ffff8884251c7000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: ffffffffc05d0218 CR3: 00000001146f0000 CR4: 00000000000006f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u003cTASK\u003e\n ftrace_mod_get_kallsym+0x1ac/0x590\n update_iter_mod+0x239/0x5b0\n s_next+0x5b/0xa0\n seq_read_iter+0x8c9/0x1070\n seq_read+0x249/0x3b0\n proc_reg_read+0x1b0/0x280\n vfs_read+0x17f/0x920\n ksys_read+0xf3/0x1c0\n do_syscall_64+0x5f/0x2e0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nThe above issue may happen as follows:\n(1) Add kprobe tracepoint;\n(2) insmod test.ko;\n(3)  Module triggers ftrace disabled;\n(4) rmmod test.ko;\n(5) cat /proc/kallsyms; --\u003e Will trigger UAF as test.ko already removed;\nftrace_mod_get_kallsym()\n...\nstrscpy(module_name, mod_map-\u003emod-\u003ename, MODULE_NAME_LEN);\n...\n\nThe problem is when a module triggers an issue with ftrace and\nsets ftrace_disable. The ftrace_disable is set when an anomaly is\ndiscovered and to prevent any more damage, ftrace stops all text\nmodification. The issue that happened was that the ftrace_disable stops\nmore than just the text modification.\n\nWhen a module is loaded, its init functions can also be traced. Because\nkallsyms deletes the init functions after a module has loaded, ftrace\nsaves them when the module is loaded and function tracing is enabled. This\nallows the output of the function trace to show the init function names\ninstead of just their raw memory addresses.\n\nWhen a module is removed, ftrace_release_mod() is called, and if\nftrace_disable is set, it just returns without doing anything more. The\nproblem here is that it leaves the mod_list still around and if kallsyms\nis called, it will call into this code and access the module memory that\nhas already been freed as it will return:\n\n  strscpy(module_name, mod_map-\u003emod-\u003ename, MODULE_NAME_LEN);\n\nWhere the \"mod\" no longer exists and triggers a UAF bug."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The dangling dereference is reached through a `read(2)` on the local `/proc/kallsyms` file, and the state is established by local module load/unload; no network or remote-peer data reaches `ftrace_mod_get_kallsym()`.\nAC:L - Scoring the vulnerable configuration (a tracer registered when the module\u0027s init text was freed, `ftrace_disabled` latched by an ftrace anomaly, module then unloaded), the stale `ftrace_mod_map` persists indefinitely and the dereference is fully deterministic \u2014 no race, no memory-layout luck, and every subsequent `/proc/kallsyms` read re-triggers it at will.\nPR:L - `/proc/kallsyms` is created mode 0444 and the module-name column is emitted regardless of `kptr_restrict`, so any unprivileged local user reaches `strscpy(module_name, mod_map-\u003emod-\u003ename, ...)` with a plain `cat`, exactly as in the reported oops from `ksys_read`.\nUI:N - The attacker\u0027s own read of `/proc/kallsyms` performs the dereference; no separate victim has to open a file, mount anything, or take any action.\nS:U - Both the freed module memory and the faulting code are kernel-internal, within the same security authority the attacker is already attacking; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - `strscpy()` reads from `mod_map-\u003emod-\u003ename` inside the freed module allocation and the result is printed straight to userspace, so once the execmem/vmalloc range is reclaimed the attacker harvests reclaimed kernel memory; `ftrace_mod_address_lookup()` also returns that dangling pointer to `kallsyms_lookup()`/`sprint_symbol()`, which copy it with no length bound and can over-read well past the object.\nI:H - A stale `struct module *` is dereferenced after its backing allocation has been returned to the module/vmalloc allocator, so reclaiming that allocation makes the kernel interpret attacker-influenced content as live module metadata \u2014 the standard use-after-free corruption primitive.\nA:H - In the common case the module range is unmapped and the access faults on a non-present kernel address, oopsing in `sized_strscpy()` as in the reported trace; because the leaked `mod_map` is never freed, any unprivileged user can panic the machine repeatedly."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:01:17.019Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d064c68781c19f378af1ae741d9132d35d24b2bb"
        },
        {
          "url": "https://git.kernel.org/stable/c/8690cd3258455bbae64f809e1d3ee0f043661c71"
        },
        {
          "url": "https://git.kernel.org/stable/c/6805582abb720681dd1c87ff677f155dcf4e86c9"
        },
        {
          "url": "https://git.kernel.org/stable/c/03a162933c4a03b9f1a84f7d8482903c7e1e11bb"
        },
        {
          "url": "https://git.kernel.org/stable/c/83a692a9792aa86249d68a8ac0b9d55ecdd255fa"
        },
        {
          "url": "https://git.kernel.org/stable/c/8e89c17dc8970c5f71a3a991f5724d4c8de42d8c"
        },
        {
          "url": "https://git.kernel.org/stable/c/f78a786ad9a5443a29eef4dae60cde85b7375129"
        },
        {
          "url": "https://git.kernel.org/stable/c/f914b52c379c12288b7623bb814d0508dbe7481d"
        }
      ],
      "title": "ftrace: Fix UAF when lookup kallsym after ftrace disabled",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38346",
    "datePublished": "2025-07-10T08:15:14.290Z",
    "dateReserved": "2025-04-16T04:51:24.006Z",
    "dateUpdated": "2026-08-05T12:01:17.019Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38346",
      "date": "2026-09-17",
      "epss": "0.00179",
      "percentile": "0.0769"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T15:00:12.000Z",
      "cve": "CVE-2025-38346",
      "id": "msrc_CVE-2025-38346",
      "initial_release_date": "2025-07-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "ftrace: Fix UAF when lookup kallsym after ftrace disabled",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-38346.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38346\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-07-10T09:15:29.573\",\"lastModified\":\"2026-07-30T06:23:08.293\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nftrace: Fix UAF when lookup kallsym after ftrace disabled\\n\\nThe following issue happens with a buggy module:\\n\\nBUG: unable to handle page fault for address: ffffffffc05d0218\\nPGD 1bd66f067 P4D 1bd66f067 PUD 1bd671067 PMD 101808067 PTE 0\\nOops: Oops: 0000 [#1] SMP KASAN PTI\\nTainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE\\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS\\nRIP: 0010:sized_strscpy+0x81/0x2f0\\nRSP: 0018:ffff88812d76fa08 EFLAGS: 00010246\\nRAX: 0000000000000000 RBX: ffffffffc0601010 RCX: dffffc0000000000\\nRDX: 0000000000000038 RSI: dffffc0000000000 RDI: ffff88812608da2d\\nRBP: 8080808080808080 R08: ffff88812608da2d R09: ffff88812608da68\\nR10: ffff88812608d82d R11: ffff88812608d810 R12: 0000000000000038\\nR13: ffff88812608da2d R14: ffffffffc05d0218 R15: fefefefefefefeff\\nFS:  00007fef552de740(0000) GS:ffff8884251c7000(0000) knlGS:0000000000000000\\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\nCR2: ffffffffc05d0218 CR3: 00000001146f0000 CR4: 00000000000006f0\\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\\nCall Trace:\\n \u003cTASK\u003e\\n ftrace_mod_get_kallsym+0x1ac/0x590\\n update_iter_mod+0x239/0x5b0\\n s_next+0x5b/0xa0\\n seq_read_iter+0x8c9/0x1070\\n seq_read+0x249/0x3b0\\n proc_reg_read+0x1b0/0x280\\n vfs_read+0x17f/0x920\\n ksys_read+0xf3/0x1c0\\n do_syscall_64+0x5f/0x2e0\\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\\n\\nThe above issue may happen as follows:\\n(1) Add kprobe tracepoint;\\n(2) insmod test.ko;\\n(3)  Module triggers ftrace disabled;\\n(4) rmmod test.ko;\\n(5) cat /proc/kallsyms; --\u003e Will trigger UAF as test.ko already removed;\\nftrace_mod_get_kallsym()\\n...\\nstrscpy(module_name, mod_map-\u003emod-\u003ename, MODULE_NAME_LEN);\\n...\\n\\nThe problem is when a module triggers an issue with ftrace and\\nsets ftrace_disable. The ftrace_disable is set when an anomaly is\\ndiscovered and to prevent any more damage, ftrace stops all text\\nmodification. The issue that happened was that the ftrace_disable stops\\nmore than just the text modification.\\n\\nWhen a module is loaded, its init functions can also be traced. Because\\nkallsyms deletes the init functions after a module has loaded, ftrace\\nsaves them when the module is loaded and function tracing is enabled. This\\nallows the output of the function trace to show the init function names\\ninstead of just their raw memory addresses.\\n\\nWhen a module is removed, ftrace_release_mod() is called, and if\\nftrace_disable is set, it just returns without doing anything more. The\\nproblem here is that it leaves the mod_list still around and if kallsyms\\nis called, it will call into this code and access the module memory that\\nhas already been freed as it will return:\\n\\n  strscpy(module_name, mod_map-\u003emod-\u003ename, MODULE_NAME_LEN);\\n\\nWhere the \\\"mod\\\" no longer exists and triggers a UAF bug.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ftrace: Reparar UAF cuando se busca kallsym despu\u00e9s de ftrace deshabilitado El siguiente problema ocurre con un m\u00f3dulo con errores: ERROR: no se puede controlar el error de p\u00e1gina para la direcci\u00f3n: ffffffffc05d0218 PGD 1bd66f067 P4D 1bd66f067 PUD 1bd671067 PMD 101808067 PTE 0 Oops: Oops: 0000 [#1] SMP KASAN PTI Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Nombre del hardware: QEMU Standard PC (i440FX + PIIX, 1996), BIOS RIP: 0010:sized_strscpy+0x81/0x2f0 RSP: 0018:ffff88812d76fa08 EFLAGS: 00010246 RAX: 0000000000000000 RBX: fffffffc0601010 RCX: dffffc0000000000 RDX: 0000000000000038 RSI: dffffc0000000000 RDI: ffff88812608da2d RBP: 8080808080808080 R08: ffff88812608da2d R09: ffff88812608da68 R10: ffff88812608d82d R11: ffff88812608d810 R12: 000000000000038 R13: ffff88812608da2d R14: ffffffffc05d0218 R15: fefefefefefefeff FS: 00007fef552de740(0000) GS:ffff8884251c7000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffc05d0218 CR3: 00000001146f0000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 00000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Rastreo de llamadas:  ftrace_mod_get_kallsym+0x1ac/0x590 update_iter_mod+0x239/0x5b0 s_next+0x5b/0xa0 seq_read_iter+0x8c9/0x1070 seq_read+0x249/0x3b0 proc_reg_read+0x1b0/0x280 vfs_read+0x17f/0x920 ksys_read+0xf3/0x1c0 do_syscall_64+0x5f/0x2e0 entry_SYSCALL_64_after_hwframe+0x76/0x7e El problema anterior puede ocurrir de la siguiente manera: (1) Agregar punto de seguimiento de kprobe; (2) insmod test.ko; (3) El m\u00f3dulo activa ftrace deshabilitado; (4) rmmod test.ko; (5) cat /proc/kallsyms; --\u0026gt; Activar\u00e1 UAF como test.ko ya eliminado; ftrace_mod_get_kallsym() ... strscpy(module_name, mod_map-\u0026gt;mod-\u0026gt;name, MODULE_NAME_LEN); ... El problema es cuando un m\u00f3dulo activa un problema con ftrace y establece ftrace_disable. ftrace_disable se establece cuando se descubre una anomal\u00eda y para evitar m\u00e1s da\u00f1os, ftrace detiene toda modificaci\u00f3n de texto. El problema que ocurri\u00f3 fue que ftrace_disable detiene m\u00e1s que solo la modificaci\u00f3n de texto. Cuando se carga un m\u00f3dulo, tambi\u00e9n se pueden rastrear sus funciones de inicio. Dado que kallsyms elimina las funciones de inicio despu\u00e9s de cargar un m\u00f3dulo, ftrace las guarda cuando el m\u00f3dulo se carga y se habilita el seguimiento de funciones. Esto permite que la salida del seguimiento de funciones muestre los nombres de las funciones de inicio en lugar de solo sus direcciones de memoria. Al eliminar un m\u00f3dulo, se llama a ftrace_release_mod() y, si ftrace_disable est\u00e1 configurado, simplemente regresa sin hacer nada m\u00e1s. El problema es que deja la lista de mods (mod_list) a\u00fan activa, y si se llama a kallsyms, este ejecutar\u00e1 este c\u00f3digo y acceder\u00e1 a la memoria del m\u00f3dulo ya liberada, ya que devolver\u00e1: strscpy(module_name, mod_map-\u0026gt;mod-\u0026gt;name, MODULE_NAME_LEN); Donde el \\\"mod\\\" ya no existe, lo que genera un error de UAF.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"kernel/trace/ftrace.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"aba4b5c22cbac296f4081a0476d0c55828f135b4\",\"lessThan\":\"d064c68781c19f378af1ae741d9132d35d24b2bb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"aba4b5c22cbac296f4081a0476d0c55828f135b4\",\"lessThan\":\"8690cd3258455bbae64f809e1d3ee0f043661c71\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"aba4b5c22cbac296f4081a0476d0c55828f135b4\",\"lessThan\":\"6805582abb720681dd1c87ff677f155dcf4e86c9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"aba4b5c22cbac296f4081a0476d0c55828f135b4\",\"lessThan\":\"03a162933c4a03b9f1a84f7d8482903c7e1e11bb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"aba4b5c22cbac296f4081a0476d0c55828f135b4\",\"lessThan\":\"83a692a9792aa86249d68a8ac0b9d55ecdd255fa\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"aba4b5c22cbac296f4081a0476d0c55828f135b4\",\"lessThan\":\"8e89c17dc8970c5f71a3a991f5724d4c8de42d8c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"aba4b5c22cbac296f4081a0476d0c55828f135b4\",\"lessThan\":\"f78a786ad9a5443a29eef4dae60cde85b7375129\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"aba4b5c22cbac296f4081a0476d0c55828f135b4\",\"lessThan\":\"f914b52c379c12288b7623bb814d0508dbe7481d\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"kernel/trace/ftrace.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.15\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.15\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.295\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.239\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.186\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.142\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.95\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.35\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15.4\",\"lessThanOrEqual\":\"6.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.15\",\"versionEndExcluding\":\"5.4.295\",\"matchCriteriaId\":\"FEB897A6-ACC8-4BCB-8BEF-1ECD86802378\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.239\",\"matchCriteriaId\":\"C3D14F4C-A21E-465D-A928-5CCE684E2B98\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.186\",\"matchCriteriaId\":\"D96F2C0D-0D4A-4658-AD34-D8A626EA422D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.142\",\"matchCriteriaId\":\"459B4E94-FE0E-434D-B782-95E3A5FFC6B1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.95\",\"matchCriteriaId\":\"C5E01853-7048-4D78-9479-9AEE41AC8456\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.35\",\"matchCriteriaId\":\"E569FD34-0076-4428-BE17-EECCF867611C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.15.4\",\"matchCriteriaId\":\"DFD174C5-1AA2-4671-BDDC-1A9FCC753655\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA6FEEC2-9F11-4643-8827-749718254FED\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/03a162933c4a03b9f1a84f7d8482903c7e1e11bb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6805582abb720681dd1c87ff677f155dcf4e86c9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/83a692a9792aa86249d68a8ac0b9d55ecdd255fa\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8690cd3258455bbae64f809e1d3ee0f043661c71\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8e89c17dc8970c5f71a3a991f5724d4c8de42d8c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d064c68781c19f378af1ae741d9132d35d24b2bb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f78a786ad9a5443a29eef4dae60cde85b7375129\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f914b52c379c12288b7623bb814d0508dbe7481d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T09:13:35+00:00",
      "cve": "CVE-2025-38346",
      "id": "CVE-2025-38346",
      "initial_release_date": "2025-07-10T00:00:00+00:00",
      "product_status:fixed": "309",
      "product_status:known_affected": "156",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ftrace: Fix UAF when lookup kallsym after ftrace disabled",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38346.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.