CVE-2025-39813

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-39813
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-39813.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-39813
Downstream
Related
Published
2025-09-16T13:00:14Z
Modified
2026-08-12T03:51:23Z
Summary
ftrace: Fix potential warning in trace_printk_seq during ftrace_dump
Details

In the Linux kernel, the following vulnerability has been resolved:

ftrace: Fix potential warning in trace_printk_seq during ftrace_dump

When calling ftrace_dump_one() concurrently with reading trace_pipe, a WARN_ON_ONCE() in trace_printk_seq() can be triggered due to a race condition.

The issue occurs because:

CPU0 (ftrace_dump) CPU1 (reader) echo z > /proc/sysrq-trigger

!trace_empty(&iter) trace_iterator_reset(&iter) <- len = size = 0 cat /sys/kernel/tracing/trace_pipe trace_find_next_entry_inc(&iter) __find_next_entry ring_buffer_empty_cpu <- all empty return NULL

trace_printk_seq(&iter.seq) WARN_ON_ONCE(s->seq.len >= s->seq.size)

In the context between trace_empty() and trace_find_next_entry_inc() during ftrace_dump, the ring buffer data was consumed by other readers. This caused trace_find_next_entry_inc to return NULL, failing to populate iter.seq. At this point, due to the prior trace_iterator_reset, both iter.seq.len and iter.seq.size were set to 0. Since they are equal, the WARN_ON_ONCE condition is triggered.

Move the trace_printk_seq() into the if block that checks to make sure the return value of trace_find_next_entry_inc() is non-NULL in ftrace_dump_one(), ensuring the 'iter.seq' is properly populated before subsequent operations.

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/39xxx/CVE-2025-39813.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
d769041f865330034131525ee6a7f72eb4af2a24
Fixed
f299353e7ccbcc5c2ed8993c48fbe7609cbe729a
Fixed
5ab0ec206deb99eb3baf8f1d7602aeaa91dbcc85
Fixed
a6f0f8873cc30fd4543b09adf03f7f51d293f0e6
Fixed
e80ff23ba8bdb0f41a1afe2657078e4097d13a9a
Fixed
28c8fb7ae2ad27d81c8de3c4fe608c509f6a18aa
Fixed
ced94e137e6cd5e79c65564841d3b7695d0f5fa3
Fixed
fbd4cf7ee4db65ef36796769fe978e9eba6f0de4
Fixed
4013aef2ced9b756a410f50d12df9ebe6a883e4a

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-39813.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.6.28
Fixed
5.4.298
Type
ECOSYSTEM
Events
Introduced
5.5.0
Fixed
5.10.242
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.191
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.150
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.104
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.45
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.16.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-39813.json"