GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-21899 (GCVE-0-2025-21899)

Vulnerability from cvelistv5 – Published: 2025-04-01 15:26 – Updated: 2026-08-05 11:55
VLAI
Title
tracing: Fix bad hist from corrupting named_triggers list
Summary
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix bad hist from corrupting named_triggers list The following commands causes a crash: ~# cd /sys/kernel/tracing/events/rcu/rcu_callback ~# echo 'hist:name=bad:keys=common_pid:onmax(bogus).save(common_pid)' > trigger bash: echo: write error: Invalid argument ~# echo 'hist:name=bad:keys=common_pid' > trigger Because the following occurs: event_trigger_write() { trigger_process_regex() { event_hist_trigger_parse() { data = event_trigger_alloc(..); event_trigger_register(.., data) { cmd_ops->reg(.., data, ..) [hist_register_trigger()] { data->ops->init() [event_hist_trigger_init()] { save_named_trigger(name, data) { list_add(&data->named_list, &named_triggers); } } } } ret = create_actions(); (return -EINVAL) if (ret) goto out_unreg; [..] ret = hist_trigger_enable(data, ...) { list_add_tail_rcu(&data->list, &file->triggers); <<<---- SKIPPED!!! (this is important!) [..] out_unreg: event_hist_unregister(.., data) { cmd_ops->unreg(.., data, ..) [hist_unregister_trigger()] { list_for_each_entry(iter, &file->triggers, list) { if (!hist_trigger_match(data, iter, named_data, false)) <- never matches continue; [..] test = iter; } if (test && test->ops->free) <<<-- test is NULL test->ops->free(test) [event_hist_trigger_free()] { [..] if (data->name) del_named_trigger(data) { list_del(&data->named_list); <<<<-- NEVER gets removed! } } } } [..] kfree(data); <<<-- frees item but it is still on list The next time a hist with name is registered, it causes an u-a-f bug and the kernel can crash. Move the code around such that if event_trigger_register() succeeds, the next thing called is hist_trigger_enable() which adds it to the list. A bunch of actions is called if get_named_trigger_data() returns false. But that doesn't need to be called after event_trigger_register(), so it can be moved up, allowing event_trigger_register() to be called just before hist_trigger_enable() keeping them together and allowing the file->triggers to be properly populated.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 067fe038e70f6e64960d26a79c4df5f1413d0f13 , < 5ae1b18f05ee2b849dc03b6c15d7da0c1c6efa77 (git)
Affected: 067fe038e70f6e64960d26a79c4df5f1413d0f13 , < 43b254d46c740bf9dbe65709afa021dd726dfa99 (git)
Affected: 067fe038e70f6e64960d26a79c4df5f1413d0f13 , < 435d2964af815aae456db554c62963b4515f19d0 (git)
Affected: 067fe038e70f6e64960d26a79c4df5f1413d0f13 , < f1ae50cfb818ce1ac7a674406dfadb7653e2552d (git)
Affected: 067fe038e70f6e64960d26a79c4df5f1413d0f13 , < 6f86bdeab633a56d5c6dccf1a2c5989b6a5e323e (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.17
Unaffected: 0 , < 4.17 (semver)
Unaffected: 6.1.130 , ≤ 6.1.* (semver)
Unaffected: 6.6.81 , ≤ 6.6.* (semver)
Unaffected: 6.12.18 , ≤ 6.12.* (semver)
Unaffected: 6.13.6 , ≤ 6.13.* (semver)
Unaffected: 6.14 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:38:45.924Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/trace_events_hist.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5ae1b18f05ee2b849dc03b6c15d7da0c1c6efa77",
              "status": "affected",
              "version": "067fe038e70f6e64960d26a79c4df5f1413d0f13",
              "versionType": "git"
            },
            {
              "lessThan": "43b254d46c740bf9dbe65709afa021dd726dfa99",
              "status": "affected",
              "version": "067fe038e70f6e64960d26a79c4df5f1413d0f13",
              "versionType": "git"
            },
            {
              "lessThan": "435d2964af815aae456db554c62963b4515f19d0",
              "status": "affected",
              "version": "067fe038e70f6e64960d26a79c4df5f1413d0f13",
              "versionType": "git"
            },
            {
              "lessThan": "f1ae50cfb818ce1ac7a674406dfadb7653e2552d",
              "status": "affected",
              "version": "067fe038e70f6e64960d26a79c4df5f1413d0f13",
              "versionType": "git"
            },
            {
              "lessThan": "6f86bdeab633a56d5c6dccf1a2c5989b6a5e323e",
              "status": "affected",
              "version": "067fe038e70f6e64960d26a79c4df5f1413d0f13",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/trace_events_hist.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.17"
            },
            {
              "lessThan": "4.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.130",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.81",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.130",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.81",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.18",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.6",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Fix bad hist from corrupting named_triggers list\n\nThe following commands causes a crash:\n\n ~# cd /sys/kernel/tracing/events/rcu/rcu_callback\n ~# echo \u0027hist:name=bad:keys=common_pid:onmax(bogus).save(common_pid)\u0027 \u003e trigger\n bash: echo: write error: Invalid argument\n ~# echo \u0027hist:name=bad:keys=common_pid\u0027 \u003e trigger\n\nBecause the following occurs:\n\nevent_trigger_write() {\n  trigger_process_regex() {\n    event_hist_trigger_parse() {\n\n      data = event_trigger_alloc(..);\n\n      event_trigger_register(.., data) {\n        cmd_ops-\u003ereg(.., data, ..) [hist_register_trigger()] {\n          data-\u003eops-\u003einit() [event_hist_trigger_init()] {\n            save_named_trigger(name, data) {\n              list_add(\u0026data-\u003enamed_list, \u0026named_triggers);\n            }\n          }\n        }\n      }\n\n      ret = create_actions(); (return -EINVAL)\n      if (ret)\n        goto out_unreg;\n[..]\n      ret = hist_trigger_enable(data, ...) {\n        list_add_tail_rcu(\u0026data-\u003elist, \u0026file-\u003etriggers); \u003c\u003c\u003c---- SKIPPED!!! (this is important!)\n[..]\n out_unreg:\n      event_hist_unregister(.., data) {\n        cmd_ops-\u003eunreg(.., data, ..) [hist_unregister_trigger()] {\n          list_for_each_entry(iter, \u0026file-\u003etriggers, list) {\n            if (!hist_trigger_match(data, iter, named_data, false))   \u003c- never matches\n                continue;\n            [..]\n            test = iter;\n          }\n          if (test \u0026\u0026 test-\u003eops-\u003efree) \u003c\u003c\u003c-- test is NULL\n\n            test-\u003eops-\u003efree(test) [event_hist_trigger_free()] {\n              [..]\n              if (data-\u003ename)\n                del_named_trigger(data) {\n                  list_del(\u0026data-\u003enamed_list);  \u003c\u003c\u003c\u003c-- NEVER gets removed!\n                }\n              }\n           }\n         }\n\n         [..]\n         kfree(data); \u003c\u003c\u003c-- frees item but it is still on list\n\nThe next time a hist with name is registered, it causes an u-a-f bug and\nthe kernel can crash.\n\nMove the code around such that if event_trigger_register() succeeds, the\nnext thing called is hist_trigger_enable() which adds it to the list.\n\nA bunch of actions is called if get_named_trigger_data() returns false.\nBut that doesn\u0027t need to be called after event_trigger_register(), so it\ncan be moved up, allowing event_trigger_register() to be called just\nbefore hist_trigger_enable() keeping them together and allowing the\nfile-\u003etriggers to be properly populated."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached only by writing a hist trigger command to a tracefs file (`/sys/kernel/tracing/events/*/trigger`) via the write(2) syscall. There is no network or remote data path into `event_hist_trigger_parse()`.\nAC:L - Triggering is fully deterministic \u2014 one failing `hist:name=bad:...onmax(bogus)...` write leaves the freed object linked in the global `named_triggers` list, and a second `hist:name=bad` write dereferences it; no race and no uncontrollable preconditions. `CONFIG_HIST_TRIGGERS=y` is standard in mainstream distro and Android kernels, and slab reclaim of the freed `event_trigger_data` is attacker-influenced via ordinary heap spraying.\nPR:L - No capability check exists on the code path; access is gated purely by tracefs file permissions, and tracefs is routinely delegated to a non-root tracing/shell group (Android shell, ChromeOS debugd, perf/tracing groups) via the `gid=` mount option. A local unprivileged user with that ordinary tracing access can execute the full sequence.\nUI:N - The attacker performs both writes themselves; no victim action or cooperation is needed at any point.\nS:U - The use-after-free and list corruption occur in kernel memory within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - `find_named_trigger()` and `hist_trigger_match()` dereference the freed object\u0027s `name` and `private_data` pointers, so after reclaiming the slab object the attacker controls those pointers and obtains an arbitrary kernel-memory read primitive, plus leakage of the `named_triggers` list-head address.\nI:H - The freed object remains on a global list, so subsequent `list_add`/`list_del` operations write through attacker-controlled `named_list` pointers, and `data-\u003eprivate_data = named_data-\u003eprivate_data` produces type confusion into `hist_trigger_data` \u2014 a classic UAF write primitive usable for control-flow hijack.\nA:H - As stated in the commit, the second named-hist registration causes a use-after-free that crashes the kernel; list corruption reliably produces an oops or panic, denying service to the whole system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:55:14.373Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5ae1b18f05ee2b849dc03b6c15d7da0c1c6efa77"
        },
        {
          "url": "https://git.kernel.org/stable/c/43b254d46c740bf9dbe65709afa021dd726dfa99"
        },
        {
          "url": "https://git.kernel.org/stable/c/435d2964af815aae456db554c62963b4515f19d0"
        },
        {
          "url": "https://git.kernel.org/stable/c/f1ae50cfb818ce1ac7a674406dfadb7653e2552d"
        },
        {
          "url": "https://git.kernel.org/stable/c/6f86bdeab633a56d5c6dccf1a2c5989b6a5e323e"
        }
      ],
      "title": "tracing: Fix bad hist from corrupting named_triggers list",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21899",
    "datePublished": "2025-04-01T15:26:50.791Z",
    "dateReserved": "2024-12-29T08:45:45.783Z",
    "dateUpdated": "2026-08-05T11:55:14.373Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-21899",
      "date": "2026-09-15",
      "epss": "0.00212",
      "percentile": "0.11633"
    },
    "microsoft_vex": {
      "current_release_date": "2026-03-31T15:01:32.000Z",
      "cve": "CVE-2025-21899",
      "id": "msrc_CVE-2025-21899",
      "initial_release_date": "2025-04-02T00:00:00.000Z",
      "product_status:known_affected": "3",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "tracing: Fix bad hist from corrupting named_triggers list",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-21899.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-21899\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-04-01T16:15:20.327\",\"lastModified\":\"2026-07-30T06:21:56.000\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntracing: Fix bad hist from corrupting named_triggers list\\n\\nThe following commands causes a crash:\\n\\n ~# cd /sys/kernel/tracing/events/rcu/rcu_callback\\n ~# echo \u0027hist:name=bad:keys=common_pid:onmax(bogus).save(common_pid)\u0027 \u003e trigger\\n bash: echo: write error: Invalid argument\\n ~# echo \u0027hist:name=bad:keys=common_pid\u0027 \u003e trigger\\n\\nBecause the following occurs:\\n\\nevent_trigger_write() {\\n  trigger_process_regex() {\\n    event_hist_trigger_parse() {\\n\\n      data = event_trigger_alloc(..);\\n\\n      event_trigger_register(.., data) {\\n        cmd_ops-\u003ereg(.., data, ..) [hist_register_trigger()] {\\n          data-\u003eops-\u003einit() [event_hist_trigger_init()] {\\n            save_named_trigger(name, data) {\\n              list_add(\u0026data-\u003enamed_list, \u0026named_triggers);\\n            }\\n          }\\n        }\\n      }\\n\\n      ret = create_actions(); (return -EINVAL)\\n      if (ret)\\n        goto out_unreg;\\n[..]\\n      ret = hist_trigger_enable(data, ...) {\\n        list_add_tail_rcu(\u0026data-\u003elist, \u0026file-\u003etriggers); \u003c\u003c\u003c---- SKIPPED!!! (this is important!)\\n[..]\\n out_unreg:\\n      event_hist_unregister(.., data) {\\n        cmd_ops-\u003eunreg(.., data, ..) [hist_unregister_trigger()] {\\n          list_for_each_entry(iter, \u0026file-\u003etriggers, list) {\\n            if (!hist_trigger_match(data, iter, named_data, false))   \u003c- never matches\\n                continue;\\n            [..]\\n            test = iter;\\n          }\\n          if (test \u0026\u0026 test-\u003eops-\u003efree) \u003c\u003c\u003c-- test is NULL\\n\\n            test-\u003eops-\u003efree(test) [event_hist_trigger_free()] {\\n              [..]\\n              if (data-\u003ename)\\n                del_named_trigger(data) {\\n                  list_del(\u0026data-\u003enamed_list);  \u003c\u003c\u003c\u003c-- NEVER gets removed!\\n                }\\n              }\\n           }\\n         }\\n\\n         [..]\\n         kfree(data); \u003c\u003c\u003c-- frees item but it is still on list\\n\\nThe next time a hist with name is registered, it causes an u-a-f bug and\\nthe kernel can crash.\\n\\nMove the code around such that if event_trigger_register() succeeds, the\\nnext thing called is hist_trigger_enable() which adds it to the list.\\n\\nA bunch of actions is called if get_named_trigger_data() returns false.\\nBut that doesn\u0027t need to be called after event_trigger_register(), so it\\ncan be moved up, allowing event_trigger_register() to be called just\\nbefore hist_trigger_enable() keeping them together and allowing the\\nfile-\u003etriggers to be properly populated.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: tracing: Fix bad hist from corrupting named_triggers list Los siguientes comandos provocan un bloqueo: ~# cd /sys/kernel/tracing/events/rcu/rcu_callback ~# echo \u0027hist:name=bad:keys=common_pid:onmax(bogus).save(common_pid)\u0027 \u0026gt; trigger bash: echo: error de escritura: argumento no v\u00e1lido ~# echo \u0027hist:name=bad:keys=common_pid\u0027 \u0026gt; trigger Porque ocurre lo siguiente: event_trigger_write() { trigger_process_regex() { event_hist_trigger_parse() { data = event_trigger_alloc(..); event_trigger_register(.., data) { cmd_ops-\u0026gt;reg(.., data, ..) [hist_register_trigger()] { data-\u0026gt;ops-\u0026gt;init() [event_hist_trigger_init()] { save_named_trigger(name, data) { list_add(\u0026amp;data-\u0026gt;named_list, \u0026amp;named_triggers); } } } } ret = create_actions(); (return -EINVAL) if (ret) goto out_unreg; [..] ret = hist_trigger_enable(data, ...) { list_add_tail_rcu(\u0026amp;data-\u0026gt;list, \u0026amp;file-\u0026gt;triggers); \u0026lt;\u0026lt;\u0026lt;---- \u00a1\u00a1\u00a1SALTAR!!! (\u00a1esto es importante!) [..] out_unreg: event_hist_unregister(.., data) { cmd_ops-\u0026gt;unreg(.., data, ..) [hist_unregister_trigger()] { list_for_each_entry(iter, \u0026amp;file-\u0026gt;triggers, list) { if (!hist_trigger_match(data, iter, named_data, false)) \u0026lt;- never matches continue; [..] test = iter; } if (test \u0026amp;\u0026amp; test-\u0026gt;ops-\u0026gt;free) \u0026lt;\u0026lt;\u0026lt;-- test is NULL test-\u0026gt;ops-\u0026gt;free(test) [event_hist_trigger_free()] { [..] if (data-\u0026gt;name) del_named_trigger(data) { list_del(\u0026amp;data-\u0026gt;named_list); \u0026lt;\u0026lt;\u0026lt;\u0026lt;-- \u00a1NUNCA se elimina! } } } } [..] kfree(datos); \u0026lt;\u0026lt;\u0026lt;-- libera el elemento, pero sigue en la lista. La pr\u00f3xima vez que se registre un hist con nombre, se producir\u00e1 un error de uaf y el kernel podr\u00eda bloquearse. Desplace el c\u00f3digo de forma que, si event_trigger_register() tiene \u00e9xito, se llame a hist_trigger_enable(), lo que lo a\u00f1ade a la lista. Se invocan varias acciones si get_named_trigger_data() devuelve falso. Sin embargo, no es necesario llamarlo despu\u00e9s de event_trigger_register(), por lo que se puede adelantar, lo que permite llamar a event_trigger_register() justo antes de hist_trigger_enable(), manteni\u00e9ndolos juntos y permitiendo que los disparadores de archivo se rellenen correctamente.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"kernel/trace/trace_events_hist.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"067fe038e70f6e64960d26a79c4df5f1413d0f13\",\"lessThan\":\"5ae1b18f05ee2b849dc03b6c15d7da0c1c6efa77\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"067fe038e70f6e64960d26a79c4df5f1413d0f13\",\"lessThan\":\"43b254d46c740bf9dbe65709afa021dd726dfa99\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"067fe038e70f6e64960d26a79c4df5f1413d0f13\",\"lessThan\":\"435d2964af815aae456db554c62963b4515f19d0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"067fe038e70f6e64960d26a79c4df5f1413d0f13\",\"lessThan\":\"f1ae50cfb818ce1ac7a674406dfadb7653e2552d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"067fe038e70f6e64960d26a79c4df5f1413d0f13\",\"lessThan\":\"6f86bdeab633a56d5c6dccf1a2c5989b6a5e323e\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"kernel/trace/trace_events_hist.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.17\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.17\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.130\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.81\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.18\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13.6\",\"lessThanOrEqual\":\"6.13.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.14\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.17\",\"versionEndExcluding\":\"6.1.130\",\"matchCriteriaId\":\"9643A203-C3F3-4DA9-9231-44A49734AB6A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.81\",\"matchCriteriaId\":\"8C92C9CD-2ADE-412E-A7FF-DC9E0630B25D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.18\",\"matchCriteriaId\":\"3D5C8D9A-4013-4C1A-810F-AA540BB5737C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.13.6\",\"matchCriteriaId\":\"64F12D9B-71C2-4CD7-A288-0D5EF1709620\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"186716B6-2B66-4BD0-852E-D48E71C0C85F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"0D3E781C-403A-498F-9DA9-ECEE50F41E75\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"66619FB8-0AAF-4166-B2CF-67B24143261D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"D3D6550E-6679-4560-902D-AF52DCFE905B\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/435d2964af815aae456db554c62963b4515f19d0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/43b254d46c740bf9dbe65709afa021dd726dfa99\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5ae1b18f05ee2b849dc03b6c15d7da0c1c6efa77\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6f86bdeab633a56d5c6dccf1a2c5989b6a5e323e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f1ae50cfb818ce1ac7a674406dfadb7653e2552d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T09:38:14+00:00",
      "cve": "CVE-2025-21899",
      "id": "CVE-2025-21899",
      "initial_release_date": "2025-04-01T00:00:00+00:00",
      "product_status:known_affected": "156",
      "product_status:known_not_affected": "118",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: tracing: Fix bad hist from corrupting named_triggers list",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-21899.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-31T13:49:21Z",
      "cve": "CVE-2025-21899",
      "id": "CVE-2025-21899",
      "initial_release_date": "2025-04-02T13:29:30Z",
      "product_status:known_affected": "649",
      "product_status:known_not_affected": "187",
      "product_status:recommended": "396",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-21899",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-21899.json",
      "version": "48"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.