SB2025052106 - Use-after-free in Linux kernel trace
Published: May 21, 2025 Updated: May 21, 2025
Security Bulletin ID
SB2025052106
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Use-after-free (CVE-ID: CVE-2025-37938)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a use-after-free error within the test_event_printk() function in kernel/trace/trace_events.c. A local user can escalate privileges on the system.
Remediation
Install update from vendor's website.
References
- https://git.kernel.org/stable/c/03127354027508d076073b020d3070990fd6a958
- https://git.kernel.org/stable/c/04b80d45ecfaf780981d6582899e3ab205e4aa08
- https://git.kernel.org/stable/c/4d11fac941d83509be4e6a21038281d6d96da50c
- https://git.kernel.org/stable/c/6854c87ac823181c810f8c07489ba543260c0023
- https://git.kernel.org/stable/c/c7204fd1758c0caf1938e8a59809a1fdf28a8114
- https://git.kernel.org/stable/c/ea8d7647f9ddf1f81e2027ed305299797299aa03
- https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.136
- https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.26
- https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.13.11
- https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.14.2
- https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.89