In the Linux kernel, the following vulnerability has been resolved:
tracing: Limit access to parser->buffer when tracegetuser failed
When the length of the string written to setftracefilter exceeds FTRACEBUFFMAX, the following KASAN alarm will be triggered:
BUG: KASAN: slab-out-of-bounds in strsep+0x18c/0x1b0 Read of size 1 at addr ffff0000d00bd5ba by task ash/165
CPU: 1 UID: 0 PID: 165 Comm: ash Not tainted 6.16.0-g6bcdbd62bd56-dirty Hardware name: linux,dummy-virt (DT) Call trace: showstack+0x34/0x50 (C) dumpstacklvl+0xa0/0x158 printaddressdescription.constprop.0+0x88/0x398 printreport+0xb0/0x280 kasanreport+0xa4/0xf0 asanreportload1noabort+0x20/0x30 strsep+0x18c/0x1b0 ftraceprocessregex.isra.0+0x100/0x2d8 ftraceregexrelease+0x484/0x618 _fput+0x364/0xa58 _fput+0x28/0x40 taskworkrun+0x154/0x278 donotifyresume+0x1f0/0x220 el0svc+0xec/0xf0 el0t64synchandler+0xa0/0xe8 el0t64sync+0x1ac/0x1b0
The reason is that tracegetuser will fail when processing a string longer than FTRACEBUFFMAX, but not set the end of parser->buffer to 0. Then an OOB access will be triggered in ftraceregexrelease-> ftraceprocessregex->strsep->strpbrk. We can solve this problem by limiting access to parser->buffer when tracegetuser failed.
[
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"147847774198213494733079420265985779261",
"67070860631628677212911754813072546186",
"182126549656592829727519621663655765451",
"19115681959520356037771344020737427015",
"282408055757607328462358944341558347678",
"189041093501678461029672120581722592985",
"153422389934985568968468321775235886286",
"229852814582812242109693748677579681605",
"289152710007355049544641793277831704021",
"67833711004923111594553146725160159204",
"256634771077971517761841343137814253585"
]
},
"id": "CVE-2025-39683-0c4bd783",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6a909ea83f226803ea0e718f6e88613df9234d58",
"signature_version": "v1",
"target": {
"file": "kernel/trace/trace.h"
},
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"147847774198213494733079420265985779261",
"67070860631628677212911754813072546186",
"182126549656592829727519621663655765451",
"19115681959520356037771344020737427015",
"282408055757607328462358944341558347678",
"189041093501678461029672120581722592985",
"153422389934985568968468321775235886286",
"229852814582812242109693748677579681605",
"289152710007355049544641793277831704021",
"67833711004923111594553146725160159204",
"256634771077971517761841343137814253585"
]
},
"id": "CVE-2025-39683-17288a61",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3079517a5ba80901fe828a06998da64b9b8749be",
"signature_version": "v1",
"target": {
"file": "kernel/trace/trace.h"
},
"deprecated": false
},
{
"digest": {
"function_hash": "1074870234009964355956867255933690463",
"length": 1027.0
},
"id": "CVE-2025-39683-3a4d32ca",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6a909ea83f226803ea0e718f6e88613df9234d58",
"signature_version": "v1",
"target": {
"file": "kernel/trace/trace.c",
"function": "trace_get_user"
},
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"162208221466502474009236647938209747840",
"177266374248501120668856123152810452919",
"283672017370051570806317180655080429548",
"277037655996996286802094070870163108252",
"32942642637908833868542988498156249366",
"177266374248501120668856123152810452919",
"283672017370051570806317180655080429548",
"338119224912708757662440614004205581412",
"235149363443514172283560610620172922011",
"154156118655963452415945926115618039575",
"304472747282747572729682045505064752703",
"91252880853183323513375403515933410768",
"331874447894940584316141686060495916739",
"177266374248501120668856123152810452919",
"283672017370051570806317180655080429548",
"338119224912708757662440614004205581412",
"13600722582295463717932838194406574768",
"313911614913155853445422856216091450567",
"42740061208859928234598469263784584279",
"310997535571813832442933126669821157510",
"29918220250503108761111956951711148248",
"103221985391352393822521942724109147775",
"186799156192598317400458892238861904597"
]
},
"id": "CVE-2025-39683-3ca5db2d",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d0c68045b8b0f3737ed7bd6b8c83b7887014adee",
"signature_version": "v1",
"target": {
"file": "kernel/trace/trace.c"
},
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"162208221466502474009236647938209747840",
"177266374248501120668856123152810452919",
"283672017370051570806317180655080429548",
"277037655996996286802094070870163108252",
"32942642637908833868542988498156249366",
"177266374248501120668856123152810452919",
"283672017370051570806317180655080429548",
"338119224912708757662440614004205581412",
"235149363443514172283560610620172922011",
"154156118655963452415945926115618039575",
"304472747282747572729682045505064752703",
"91252880853183323513375403515933410768",
"331874447894940584316141686060495916739",
"177266374248501120668856123152810452919",
"283672017370051570806317180655080429548",
"338119224912708757662440614004205581412",
"13600722582295463717932838194406574768",
"313911614913155853445422856216091450567",
"42740061208859928234598469263784584279",
"310997535571813832442933126669821157510",
"29918220250503108761111956951711148248",
"103221985391352393822521942724109147775",
"186799156192598317400458892238861904597"
]
},
"id": "CVE-2025-39683-4d019811",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6a909ea83f226803ea0e718f6e88613df9234d58",
"signature_version": "v1",
"target": {
"file": "kernel/trace/trace.c"
},
"deprecated": false
},
{
"digest": {
"function_hash": "174335201304682344694620953124408990936",
"length": 81.0
},
"id": "CVE-2025-39683-5a45e245",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@58ff8064cb4c7eddac4da1a59da039ead586950a",
"signature_version": "v1",
"target": {
"file": "kernel/trace/trace.h",
"function": "trace_parser_loaded"
},
"deprecated": false
},
{
"digest": {
"function_hash": "174335201304682344694620953124408990936",
"length": 81.0
},
"id": "CVE-2025-39683-5dad256b",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d0c68045b8b0f3737ed7bd6b8c83b7887014adee",
"signature_version": "v1",
"target": {
"file": "kernel/trace/trace.h",
"function": "trace_parser_loaded"
},
"deprecated": false
},
{
"digest": {
"function_hash": "1074870234009964355956867255933690463",
"length": 1027.0
},
"id": "CVE-2025-39683-63a04058",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@58ff8064cb4c7eddac4da1a59da039ead586950a",
"signature_version": "v1",
"target": {
"file": "kernel/trace/trace.c",
"function": "trace_get_user"
},
"deprecated": false
},
{
"digest": {
"function_hash": "1074870234009964355956867255933690463",
"length": 1027.0
},
"id": "CVE-2025-39683-73449c27",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d0c68045b8b0f3737ed7bd6b8c83b7887014adee",
"signature_version": "v1",
"target": {
"file": "kernel/trace/trace.c",
"function": "trace_get_user"
},
"deprecated": false
},
{
"digest": {
"function_hash": "174335201304682344694620953124408990936",
"length": 81.0
},
"id": "CVE-2025-39683-7a83cf51",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6a909ea83f226803ea0e718f6e88613df9234d58",
"signature_version": "v1",
"target": {
"file": "kernel/trace/trace.h",
"function": "trace_parser_loaded"
},
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"147847774198213494733079420265985779261",
"67070860631628677212911754813072546186",
"182126549656592829727519621663655765451",
"19115681959520356037771344020737427015",
"282408055757607328462358944341558347678",
"189041093501678461029672120581722592985",
"153422389934985568968468321775235886286",
"229852814582812242109693748677579681605",
"289152710007355049544641793277831704021",
"67833711004923111594553146725160159204",
"256634771077971517761841343137814253585"
]
},
"id": "CVE-2025-39683-7c4af6c4",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b842ef39c2ad6156c13afdec25ecc6792a9b67b9",
"signature_version": "v1",
"target": {
"file": "kernel/trace/trace.h"
},
"deprecated": false
},
{
"digest": {
"function_hash": "174335201304682344694620953124408990936",
"length": 81.0
},
"id": "CVE-2025-39683-8e5adcf9",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3079517a5ba80901fe828a06998da64b9b8749be",
"signature_version": "v1",
"target": {
"file": "kernel/trace/trace.h",
"function": "trace_parser_loaded"
},
"deprecated": false
},
{
"digest": {
"function_hash": "1074870234009964355956867255933690463",
"length": 1027.0
},
"id": "CVE-2025-39683-8e6b676a",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b842ef39c2ad6156c13afdec25ecc6792a9b67b9",
"signature_version": "v1",
"target": {
"file": "kernel/trace/trace.c",
"function": "trace_get_user"
},
"deprecated": false
},
{
"digest": {
"function_hash": "174335201304682344694620953124408990936",
"length": 81.0
},
"id": "CVE-2025-39683-940f6477",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b842ef39c2ad6156c13afdec25ecc6792a9b67b9",
"signature_version": "v1",
"target": {
"file": "kernel/trace/trace.h",
"function": "trace_parser_loaded"
},
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"162208221466502474009236647938209747840",
"177266374248501120668856123152810452919",
"283672017370051570806317180655080429548",
"277037655996996286802094070870163108252",
"32942642637908833868542988498156249366",
"177266374248501120668856123152810452919",
"283672017370051570806317180655080429548",
"338119224912708757662440614004205581412",
"235149363443514172283560610620172922011",
"154156118655963452415945926115618039575",
"304472747282747572729682045505064752703",
"91252880853183323513375403515933410768",
"331874447894940584316141686060495916739",
"177266374248501120668856123152810452919",
"283672017370051570806317180655080429548",
"338119224912708757662440614004205581412",
"13600722582295463717932838194406574768",
"313911614913155853445422856216091450567",
"42740061208859928234598469263784584279",
"310997535571813832442933126669821157510",
"29918220250503108761111956951711148248",
"103221985391352393822521942724109147775",
"186799156192598317400458892238861904597"
]
},
"id": "CVE-2025-39683-96310a3b",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@58ff8064cb4c7eddac4da1a59da039ead586950a",
"signature_version": "v1",
"target": {
"file": "kernel/trace/trace.c"
},
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"162208221466502474009236647938209747840",
"177266374248501120668856123152810452919",
"283672017370051570806317180655080429548",
"277037655996996286802094070870163108252",
"32942642637908833868542988498156249366",
"177266374248501120668856123152810452919",
"283672017370051570806317180655080429548",
"338119224912708757662440614004205581412",
"235149363443514172283560610620172922011",
"154156118655963452415945926115618039575",
"304472747282747572729682045505064752703",
"91252880853183323513375403515933410768",
"331874447894940584316141686060495916739",
"177266374248501120668856123152810452919",
"283672017370051570806317180655080429548",
"338119224912708757662440614004205581412",
"13600722582295463717932838194406574768",
"313911614913155853445422856216091450567",
"42740061208859928234598469263784584279",
"310997535571813832442933126669821157510",
"29918220250503108761111956951711148248",
"103221985391352393822521942724109147775",
"186799156192598317400458892238861904597"
]
},
"id": "CVE-2025-39683-9718d1c1",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3079517a5ba80901fe828a06998da64b9b8749be",
"signature_version": "v1",
"target": {
"file": "kernel/trace/trace.c"
},
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"147847774198213494733079420265985779261",
"67070860631628677212911754813072546186",
"182126549656592829727519621663655765451",
"19115681959520356037771344020737427015",
"282408055757607328462358944341558347678",
"189041093501678461029672120581722592985",
"153422389934985568968468321775235886286",
"229852814582812242109693748677579681605",
"289152710007355049544641793277831704021",
"67833711004923111594553146725160159204",
"256634771077971517761841343137814253585"
]
},
"id": "CVE-2025-39683-ad347e0f",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@58ff8064cb4c7eddac4da1a59da039ead586950a",
"signature_version": "v1",
"target": {
"file": "kernel/trace/trace.h"
},
"deprecated": false
},
{
"digest": {
"function_hash": "1074870234009964355956867255933690463",
"length": 1027.0
},
"id": "CVE-2025-39683-d4f07dce",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3079517a5ba80901fe828a06998da64b9b8749be",
"signature_version": "v1",
"target": {
"file": "kernel/trace/trace.c",
"function": "trace_get_user"
},
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"147847774198213494733079420265985779261",
"67070860631628677212911754813072546186",
"182126549656592829727519621663655765451",
"19115681959520356037771344020737427015",
"282408055757607328462358944341558347678",
"189041093501678461029672120581722592985",
"153422389934985568968468321775235886286",
"229852814582812242109693748677579681605",
"289152710007355049544641793277831704021",
"67833711004923111594553146725160159204",
"256634771077971517761841343137814253585"
]
},
"id": "CVE-2025-39683-f15e095e",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d0c68045b8b0f3737ed7bd6b8c83b7887014adee",
"signature_version": "v1",
"target": {
"file": "kernel/trace/trace.h"
},
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"162208221466502474009236647938209747840",
"177266374248501120668856123152810452919",
"283672017370051570806317180655080429548",
"277037655996996286802094070870163108252",
"32942642637908833868542988498156249366",
"177266374248501120668856123152810452919",
"283672017370051570806317180655080429548",
"338119224912708757662440614004205581412",
"235149363443514172283560610620172922011",
"154156118655963452415945926115618039575",
"304472747282747572729682045505064752703",
"91252880853183323513375403515933410768",
"331874447894940584316141686060495916739",
"177266374248501120668856123152810452919",
"283672017370051570806317180655080429548",
"338119224912708757662440614004205581412",
"13600722582295463717932838194406574768",
"313911614913155853445422856216091450567",
"42740061208859928234598469263784584279",
"310997535571813832442933126669821157510",
"29918220250503108761111956951711148248",
"103221985391352393822521942724109147775",
"186799156192598317400458892238861904597"
]
},
"id": "CVE-2025-39683-f3549be7",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b842ef39c2ad6156c13afdec25ecc6792a9b67b9",
"signature_version": "v1",
"target": {
"file": "kernel/trace/trace.c"
},
"deprecated": false
}
]