ftrace: Fix potential warning in trace_printk_seq during ftrace_dump

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2025-39813
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2025-09-16 13:15:55 UTC
Updated2026-05-12 13:17:13 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: ftrace: Fix potential warning in trace_printk_seq during ftrace_dump When calling ftrace_dump_one() concurrently with reading trace_pipe, a WARN_ON_ONCE() in trace_printk_seq() can be triggered due to a race condition. The issue occurs because: CPU0 (ftrace_dump) CPU1 (reader) echo z > /proc/sysrq-trigger !trace_empty(&iter) trace_iterator_reset(&iter) <- len = size = 0 cat /sys/kernel/tracing/trace_pipe trace_find_next_entry_inc(&iter) __find_next_entry ring_buffer_empty_cpu <- all empty return NULL trace_printk_seq(&iter.seq) WARN_ON_ONCE(s->seq.len >= s->seq.size) In the context between trace_empty() and trace_find_next_entry_inc() during ftrace_dump, the ring buffer data was consumed by other readers. This caused trace_find_next_entry_inc to return NULL, failing to populate `iter.seq`. At this point, due to the prior trace_iterator_reset, both `iter.seq.len` and `iter.seq.size` were set to 0. Since they are equal, the WARN_ON_ONCE condition is triggered. Move the trace_printk_seq() into the if block that checks to make sure the return value of trace_find_next_entry_inc() is non-NULL in ftrace_dump_one(), ensuring the 'iter.seq' is properly populated before subsequent operations.

Risk And Classification

Primary CVSS: v3.1 4.7 MEDIUM from [email protected]

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Problem Types: CWE-362

CVSS v3.1 Breakdown

Attack Vector
Local
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

NVD Known Affected Configurations (CPE 2.3)

TypeVendorProductVersionUpdateEditionLanguage
Operating System Linux Linux Kernel All All All All

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected d769041f865330034131525ee6a7f72eb4af2a24 f299353e7ccbcc5c2ed8993c48fbe7609cbe729a git Not specified
CNA Linux Linux affected d769041f865330034131525ee6a7f72eb4af2a24 5ab0ec206deb99eb3baf8f1d7602aeaa91dbcc85 git Not specified
CNA Linux Linux affected d769041f865330034131525ee6a7f72eb4af2a24 a6f0f8873cc30fd4543b09adf03f7f51d293f0e6 git Not specified
CNA Linux Linux affected d769041f865330034131525ee6a7f72eb4af2a24 e80ff23ba8bdb0f41a1afe2657078e4097d13a9a git Not specified
CNA Linux Linux affected d769041f865330034131525ee6a7f72eb4af2a24 28c8fb7ae2ad27d81c8de3c4fe608c509f6a18aa git Not specified
CNA Linux Linux affected d769041f865330034131525ee6a7f72eb4af2a24 ced94e137e6cd5e79c65564841d3b7695d0f5fa3 git Not specified
CNA Linux Linux affected d769041f865330034131525ee6a7f72eb4af2a24 fbd4cf7ee4db65ef36796769fe978e9eba6f0de4 git Not specified
CNA Linux Linux affected d769041f865330034131525ee6a7f72eb4af2a24 4013aef2ced9b756a410f50d12df9ebe6a883e4a git Not specified
CNA Linux Linux affected 2.6.28 Not specified
CNA Linux Linux unaffected 2.6.28 semver Not specified
CNA Linux Linux unaffected 5.4.298 5.4.* semver Not specified
CNA Linux Linux unaffected 5.10.242 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.191 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.150 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.104 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.45 6.12.* semver Not specified
CNA Linux Linux unaffected 6.16.5 6.16.* semver Not specified
CNA Linux Linux unaffected 6.17 * original_commit_for_fix Not specified
ADP Siemens SIMATIC CN 4100 affected V5.0 custom Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/ced94e137e6cd5e79c65564841d3b7695d0f5fa3 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
lists.debian.org/debian-lts-announce/2025/10/msg00008.html af854a3a-2127-422b-91ae-364da2661108 lists.debian.org Third Party Advisory
git.kernel.org/stable/c/a6f0f8873cc30fd4543b09adf03f7f51d293f0e6 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/28c8fb7ae2ad27d81c8de3c4fe608c509f6a18aa 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/4013aef2ced9b756a410f50d12df9ebe6a883e4a 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/fbd4cf7ee4db65ef36796769fe978e9eba6f0de4 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
cert-portal.siemens.com/productcert/html/ssa-032379.html 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e cert-portal.siemens.com
git.kernel.org/stable/c/f299353e7ccbcc5c2ed8993c48fbe7609cbe729a 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/5ab0ec206deb99eb3baf8f1d7602aeaa91dbcc85 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/e80ff23ba8bdb0f41a1afe2657078e4097d13a9a 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
lists.debian.org/debian-lts-announce/2025/10/msg00007.html af854a3a-2127-422b-91ae-364da2661108 lists.debian.org Third Party Advisory
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report