CVE-2025-39683

Kernel memory corruption via unterminated tracing buffer

Published Sep 5, 2025 · Updated Sep 5, 2025

Out-of-bounds access in Linux kernel tracing allows local users to corrupt memory or crash the kernel through an overlong ftrace filter. When trace_get_user rejects a token longer than FTRACE_BUFF_MAX, it leaves parser->buffer unterminated, so ftrace_regex_release passes it to strsep and strpbrk and reads beyond its allocation. Access requires permission to write a tracefs filter file; closing that file can also write a NUL byte beyond the buffer and panic or oops the kernel.

CVSS severity7.8
High
EPSS probability0.18%
Next 30 days · Sep 16, 2026
Known exploitationUnconfirmed
Based on sourced intelligence
Hinoki checkNot available
Coverage for this vulnerability

See if you're affected

Explore vulnerability checks for your environment with Hinoki.

Book a demo

Summary

What happened

Out-of-bounds access in Linux kernel tracing allows local users to corrupt memory or crash the kernel through an overlong ftrace filter. When trace_get_user rejects a token longer than FTRACE_BUFF_MAX, it leaves parser->buffer unterminated, so ftrace_regex_release passes it to strsep and strpbrk and reads beyond its allocation. Access requires permission to write a tracefs filter file; closing that file can also write a NUL byte beyond the buffer and panic or oops the kernel.

The record

CVE
CVE-2025-39683
Published
Sep 5, 2025
Updated
Sep 5, 2025
Vendor
The Linux Kernel Organization
Product
Linux
Classifications
CWE-125, T1499
Attack vector
local
Privileges
authenticated

Timeline

How it unfolded

  1. Sep 5, 2025CVE publishedPublication date reported by the CVE source.
  2. Sep 5, 2025Record updatedLatest update available in the CVE record.

Exploitability

Present is not the same as exploitable

Compare your product and version with the public record. A matching version still requires validation against your environment.

Is a vulnerable build present?

Compare these published version ranges with your installed build and any vendor patches.

  1. Affected versionversion=0b641b25870f02e2423e494365fc5243cc1e2759
  2. Affected versionversion=24cd31752f47699b89b4b3471155c8e599a1a23a
  3. Affected versionversion=3d9281a4ac7171c808f9507f0937eb236b353905
  4. Affected versionversion=5.13
  5. Affected versionversion=634684d79733124f7470b226b0f42aada4426b07 <b842ef39c2ad6156c13afdec25ecc6792a9b67b9
  6. Affected versionversion=6ab671191f64b0da7d547e2ad4dc199ca7e5b558
  7. Affected versionversion=8c9af478c06bb1ab1422f90d8ecbc53defd44bc3 <3079517a5ba80901fe828a06998da64b9b8749be
  8. Affected versionversion=8c9af478c06bb1ab1422f90d8ecbc53defd44bc3 <418b448e1d7470da9d4d4797f71782595ee69c49
  9. Affected versionversion=8c9af478c06bb1ab1422f90d8ecbc53defd44bc3 <41b838420457802f21918df66764b6fbf829d330
  10. Affected versionversion=8c9af478c06bb1ab1422f90d8ecbc53defd44bc3 <58ff8064cb4c7eddac4da1a59da039ead586950a
  11. Affected versionversion=8c9af478c06bb1ab1422f90d8ecbc53defd44bc3 <6a909ea83f226803ea0e718f6e88613df9234d58
  12. Affected versionversion=8c9af478c06bb1ab1422f90d8ecbc53defd44bc3 <d0c68045b8b0f3737ed7bd6b8c83b7887014adee
  13. Affected versionversion=cdd107d7f18158d966c2bc136204fe826dac445c
  14. Affected versionversion=e9cb474de7ff7a970c2a3951c12ec7e3113c0c35
  15. Affected versionversion=ffd51dbfd2900e50c71b5c069fe407957e52d61f

What conditions does exploitation require?

Attack vectorlocal
Required privilegesauthenticated

What is affected?

The Linux Kernel Organization · Linuxversion=0b641b25870f02e2423e494365fc5243cc1e2759; version=24cd31752f47699b89b4b3471155c8e599a1a23a; version=3d9281a4ac7171c808f9507f0937eb236b353905; version=5.13; version=634684d79733124f7470b226b0f42aada4426b07 <b842ef39c2ad6156c13afdec25ecc6792a9b67b9; version=6ab671191f64b0da7d547e2ad4dc199ca7e5b558; version=8c9af478c06bb1ab1422f90d8ecbc53defd44bc3 <3079517a5ba80901fe828a06998da64b9b8749be; version=8c9af478c06bb1ab1422f90d8ecbc53defd44bc3 <418b448e1d7470da9d4d4797f71782595ee69c49; version=8c9af478c06bb1ab1422f90d8ecbc53defd44bc3 <41b838420457802f21918df66764b6fbf829d330; version=8c9af478c06bb1ab1422f90d8ecbc53defd44bc3 <58ff8064cb4c7eddac4da1a59da039ead586950a; version=8c9af478c06bb1ab1422f90d8ecbc53defd44bc3 <6a909ea83f226803ea0e718f6e88613df9234d58; version=8c9af478c06bb1ab1422f90d8ecbc53defd44bc3 <d0c68045b8b0f3737ed7bd6b8c83b7887014adee; version=cdd107d7f18158d966c2bc136204fe826dac445c; version=e9cb474de7ff7a970c2a3951c12ec7e3113c0c35; version=ffd51dbfd2900e50c71b5c069fe407957e52d61f

Published CVSS scores

7.8LinuxCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS describes severity. EPSS estimates exploitation probability.

Attacks

What attackers are doing with it

Daily unique IPs observed by Shadowserver honeypots for known exploited vulnerabilities (KEVs). Missing observations do not establish an absence of attacks.

Daily unique IPsNo honeypot observations are available for this CVE in the selected window.

No observations available

Sep 9, 2026Sep 15, 2026
Latest reporting daySep 15, 2026
Latest daily unique IPsUnavailable
Prior 30-day averageUnavailable
SourceShadowserver honeypots (KEV)
Vectorlocal
Privilegesauthenticated
Known exploitationUnconfirmed
Public exploitUnconfirmed

Weakness, pattern, technique

CWE-125Out-of-bounds Read
T1499Endpoint Denial of Service

Public exploit references

No public exploit references are available in this record.

Labels summarize the accepted research assessment. They do not indicate a test against your environment.

Technologies

Your stack

See the directory against your own environment.

Your stack

Check the software in your environment

Book a demo to see how Hinoki identifies affected software and validates exploitability in your environment.

Book a demo