In the Linux kernel, the following vulnerability has been resolved:
ftrace: Also allocate and copy hash for reading of filter files
Currently the reader of setftracefilter and setftracenotrace just adds the pointer to the global tracer hash to its iterator. Unlike the writer that allocates a copy of the hash, the reader keeps the pointer to the filter hashes. This is problematic because this pointer is static across function calls that release the locks that can update the global tracer hashes. This can cause UAF and similar bugs.
Allocate and copy the hash for reading the filter files like it is done for the writers. This not only fixes UAF bugs, but also makes the code a bit simpler as it doesn't have to differentiate when to free the iterator's hash between writers and readers.
[
{
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "kernel/trace/ftrace.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e0b6b223167e1edde5c82edf38e393c06eda1f13",
"digest": {
"line_hashes": [
"243777178046979292080969591682381862010",
"53797872114277921292732257351042654370",
"6340681808793325508697637890304917747",
"194884003685636964667606146580908697812",
"163782757795208039004866442766736627593",
"110220528488769167158777105457097650879",
"223233856543018226924289971859255241117",
"186765452679324177856219940694997569835",
"137612406332565302916295272825387506401",
"207786258906568048296856759858037187283",
"284373004168422323807002192262254106987",
"186613992224039026263988934284529086522",
"211718830342032651050552058365738291791",
"265115189037840574668041936030579147761",
"64485026130238071057301509005311569844"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2025-39689-0ddf0206"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "ftrace_regex_release",
"file": "kernel/trace/ftrace.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bfb336cf97df7b37b2b2edec0f69773e06d11955",
"digest": {
"function_hash": "260241791534765815469418423803662850986",
"length": 1175.0
},
"signature_type": "Function",
"id": "CVE-2025-39689-0fd3b16e"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "kernel/trace/ftrace.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@64db338140d2bad99a0a8c6a118dd60b3e1fb8cb",
"digest": {
"line_hashes": [
"243777178046979292080969591682381862010",
"53797872114277921292732257351042654370",
"6340681808793325508697637890304917747",
"194884003685636964667606146580908697812",
"163782757795208039004866442766736627593",
"110220528488769167158777105457097650879",
"223233856543018226924289971859255241117",
"186765452679324177856219940694997569835",
"137612406332565302916295272825387506401",
"207786258906568048296856759858037187283",
"284373004168422323807002192262254106987",
"186613992224039026263988934284529086522",
"211718830342032651050552058365738291791",
"265115189037840574668041936030579147761",
"64485026130238071057301509005311569844"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2025-39689-102e0526"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "ftrace_regex_open",
"file": "kernel/trace/ftrace.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e0b6b223167e1edde5c82edf38e393c06eda1f13",
"digest": {
"function_hash": "254196774797895537863565375535694430114",
"length": 1569.0
},
"signature_type": "Function",
"id": "CVE-2025-39689-24573cd4"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "ftrace_regex_release",
"file": "kernel/trace/ftrace.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c4cd93811e038d19f961985735ef7bb128078dfb",
"digest": {
"function_hash": "123276209800008695411081418021163638904",
"length": 1193.0
},
"signature_type": "Function",
"id": "CVE-2025-39689-38170dae"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "ftrace_regex_release",
"file": "kernel/trace/ftrace.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@12064e1880fc9202be75ff668205b1703d92f74f",
"digest": {
"function_hash": "123276209800008695411081418021163638904",
"length": 1193.0
},
"signature_type": "Function",
"id": "CVE-2025-39689-3a43684d"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "ftrace_regex_open",
"file": "kernel/trace/ftrace.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@64db338140d2bad99a0a8c6a118dd60b3e1fb8cb",
"digest": {
"function_hash": "254196774797895537863565375535694430114",
"length": 1569.0
},
"signature_type": "Function",
"id": "CVE-2025-39689-3fe646c3"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "ftrace_regex_open",
"file": "kernel/trace/ftrace.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c4cd93811e038d19f961985735ef7bb128078dfb",
"digest": {
"function_hash": "254196774797895537863565375535694430114",
"length": 1569.0
},
"signature_type": "Function",
"id": "CVE-2025-39689-43f2a083"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "kernel/trace/ftrace.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@12064e1880fc9202be75ff668205b1703d92f74f",
"digest": {
"line_hashes": [
"243777178046979292080969591682381862010",
"53797872114277921292732257351042654370",
"6340681808793325508697637890304917747",
"194884003685636964667606146580908697812",
"163782757795208039004866442766736627593",
"110220528488769167158777105457097650879",
"223233856543018226924289971859255241117",
"186765452679324177856219940694997569835",
"137612406332565302916295272825387506401",
"207786258906568048296856759858037187283",
"155349585717615526031197781519614745023",
"186613992224039026263988934284529086522",
"211718830342032651050552058365738291791",
"265115189037840574668041936030579147761",
"64485026130238071057301509005311569844"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2025-39689-4fe37e72"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "ftrace_regex_open",
"file": "kernel/trace/ftrace.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@12064e1880fc9202be75ff668205b1703d92f74f",
"digest": {
"function_hash": "254196774797895537863565375535694430114",
"length": 1569.0
},
"signature_type": "Function",
"id": "CVE-2025-39689-7a349564"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "ftrace_regex_release",
"file": "kernel/trace/ftrace.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e0b6b223167e1edde5c82edf38e393c06eda1f13",
"digest": {
"function_hash": "260241791534765815469418423803662850986",
"length": 1175.0
},
"signature_type": "Function",
"id": "CVE-2025-39689-7c344227"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "kernel/trace/ftrace.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a40c69f4f1ed96acbcd62e9b5ff3a596f0a91309",
"digest": {
"line_hashes": [
"243777178046979292080969591682381862010",
"53797872114277921292732257351042654370",
"6340681808793325508697637890304917747",
"194884003685636964667606146580908697812",
"163782757795208039004866442766736627593",
"110220528488769167158777105457097650879",
"223233856543018226924289971859255241117",
"186765452679324177856219940694997569835",
"137612406332565302916295272825387506401",
"207786258906568048296856759858037187283",
"284373004168422323807002192262254106987",
"186613992224039026263988934284529086522",
"211718830342032651050552058365738291791",
"265115189037840574668041936030579147761",
"64485026130238071057301509005311569844"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2025-39689-99143a56"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "kernel/trace/ftrace.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c4cd93811e038d19f961985735ef7bb128078dfb",
"digest": {
"line_hashes": [
"243777178046979292080969591682381862010",
"53797872114277921292732257351042654370",
"6340681808793325508697637890304917747",
"194884003685636964667606146580908697812",
"163782757795208039004866442766736627593",
"110220528488769167158777105457097650879",
"223233856543018226924289971859255241117",
"186765452679324177856219940694997569835",
"137612406332565302916295272825387506401",
"207786258906568048296856759858037187283",
"155349585717615526031197781519614745023",
"186613992224039026263988934284529086522",
"211718830342032651050552058365738291791",
"265115189037840574668041936030579147761",
"64485026130238071057301509005311569844"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2025-39689-9de8e40c"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "ftrace_regex_open",
"file": "kernel/trace/ftrace.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bfb336cf97df7b37b2b2edec0f69773e06d11955",
"digest": {
"function_hash": "254196774797895537863565375535694430114",
"length": 1569.0
},
"signature_type": "Function",
"id": "CVE-2025-39689-c3d86f0d"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "ftrace_regex_release",
"file": "kernel/trace/ftrace.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@64db338140d2bad99a0a8c6a118dd60b3e1fb8cb",
"digest": {
"function_hash": "260241791534765815469418423803662850986",
"length": 1175.0
},
"signature_type": "Function",
"id": "CVE-2025-39689-e00ed102"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "ftrace_regex_open",
"file": "kernel/trace/ftrace.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a40c69f4f1ed96acbcd62e9b5ff3a596f0a91309",
"digest": {
"function_hash": "254196774797895537863565375535694430114",
"length": 1569.0
},
"signature_type": "Function",
"id": "CVE-2025-39689-e676eb2f"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "kernel/trace/ftrace.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bfb336cf97df7b37b2b2edec0f69773e06d11955",
"digest": {
"line_hashes": [
"243777178046979292080969591682381862010",
"53797872114277921292732257351042654370",
"6340681808793325508697637890304917747",
"194884003685636964667606146580908697812",
"163782757795208039004866442766736627593",
"110220528488769167158777105457097650879",
"223233856543018226924289971859255241117",
"186765452679324177856219940694997569835",
"137612406332565302916295272825387506401",
"207786258906568048296856759858037187283",
"284373004168422323807002192262254106987",
"186613992224039026263988934284529086522",
"211718830342032651050552058365738291791",
"265115189037840574668041936030579147761",
"64485026130238071057301509005311569844"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2025-39689-edfbcdd5"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "ftrace_regex_release",
"file": "kernel/trace/ftrace.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a40c69f4f1ed96acbcd62e9b5ff3a596f0a91309",
"digest": {
"function_hash": "260241791534765815469418423803662850986",
"length": 1175.0
},
"signature_type": "Function",
"id": "CVE-2025-39689-f80d60c7"
}
]