GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-39683 (GCVE-0-2025-39683)

Vulnerability from cvelistv5 – Published: 2025-09-05 17:20 – Updated: 2026-08-05 12:04
VLAI
Title
tracing: Limit access to parser->buffer when trace_get_user failed
Summary
In the Linux kernel, the following vulnerability has been resolved: tracing: Limit access to parser->buffer when trace_get_user failed When the length of the string written to set_ftrace_filter exceeds FTRACE_BUFF_MAX, the following KASAN alarm will be triggered: BUG: KASAN: slab-out-of-bounds in strsep+0x18c/0x1b0 Read of size 1 at addr ffff0000d00bd5ba by task ash/165 CPU: 1 UID: 0 PID: 165 Comm: ash Not tainted 6.16.0-g6bcdbd62bd56-dirty Hardware name: linux,dummy-virt (DT) Call trace: show_stack+0x34/0x50 (C) dump_stack_lvl+0xa0/0x158 print_address_description.constprop.0+0x88/0x398 print_report+0xb0/0x280 kasan_report+0xa4/0xf0 __asan_report_load1_noabort+0x20/0x30 strsep+0x18c/0x1b0 ftrace_process_regex.isra.0+0x100/0x2d8 ftrace_regex_release+0x484/0x618 __fput+0x364/0xa58 ____fput+0x28/0x40 task_work_run+0x154/0x278 do_notify_resume+0x1f0/0x220 el0_svc+0xec/0xf0 el0t_64_sync_handler+0xa0/0xe8 el0t_64_sync+0x1ac/0x1b0 The reason is that trace_get_user will fail when processing a string longer than FTRACE_BUFF_MAX, but not set the end of parser->buffer to 0. Then an OOB access will be triggered in ftrace_regex_release-> ftrace_process_regex->strsep->strpbrk. We can solve this problem by limiting access to parser->buffer when trace_get_user failed.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 634684d79733124f7470b226b0f42aada4426b07 , < b842ef39c2ad6156c13afdec25ecc6792a9b67b9 (git)
Affected: 8c9af478c06bb1ab1422f90d8ecbc53defd44bc3 , < 41b838420457802f21918df66764b6fbf829d330 (git)
Affected: 8c9af478c06bb1ab1422f90d8ecbc53defd44bc3 , < 418b448e1d7470da9d4d4797f71782595ee69c49 (git)
Affected: 8c9af478c06bb1ab1422f90d8ecbc53defd44bc3 , < 58ff8064cb4c7eddac4da1a59da039ead586950a (git)
Affected: 8c9af478c06bb1ab1422f90d8ecbc53defd44bc3 , < d0c68045b8b0f3737ed7bd6b8c83b7887014adee (git)
Affected: 8c9af478c06bb1ab1422f90d8ecbc53defd44bc3 , < 3079517a5ba80901fe828a06998da64b9b8749be (git)
Affected: 8c9af478c06bb1ab1422f90d8ecbc53defd44bc3 , < 6a909ea83f226803ea0e718f6e88613df9234d58 (git)
Affected: 24cd31752f47699b89b4b3471155c8e599a1a23a (git)
Affected: e9cb474de7ff7a970c2a3951c12ec7e3113c0c35 (git)
Affected: 6ab671191f64b0da7d547e2ad4dc199ca7e5b558 (git)
Affected: 3d9281a4ac7171c808f9507f0937eb236b353905 (git)
Affected: 0b641b25870f02e2423e494365fc5243cc1e2759 (git)
Affected: ffd51dbfd2900e50c71b5c069fe407957e52d61f (git)
Affected: cdd107d7f18158d966c2bc136204fe826dac445c (git)
Affected: 5.10.36 , < 5.10.241 (semver)
Affected: 4.4.269 , < 4.5 (semver)
Affected: 4.9.269 , < 4.10 (semver)
Affected: 4.14.233 , < 4.15 (semver)
Affected: 4.19.191 , < 4.20 (semver)
Affected: 5.4.118 , < 5.5 (semver)
Affected: 5.11.20 , < 5.12 (semver)
Affected: 5.12.3 , < 5.13 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 5.13
Unaffected: 0 , < 5.13 (semver)
Unaffected: 5.10.241 , ≤ 5.10.* (semver)
Unaffected: 5.15.190 , ≤ 5.15.* (semver)
Unaffected: 6.1.149 , ≤ 6.1.* (semver)
Unaffected: 6.6.103 , ≤ 6.6.* (semver)
Unaffected: 6.12.44 , ≤ 6.12.* (semver)
Unaffected: 6.16.4 , ≤ 6.16.* (semver)
Unaffected: 6.17 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Siemens SIMATIC CN 4100 Affected: 0 , < V5.0 (custom)
guessed Create a notification for this product.
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP Affected: V3.1.5 , < * (custom)
guessed Create a notification for this product.
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP Affected: V3.1.5 , < * (custom)
guessed Create a notification for this product.
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP Affected: V3.1.5 , < * (custom)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:42:15.575Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC CN 4100",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V5.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-14T12:42:36.864Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/trace.c",
            "kernel/trace/trace.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b842ef39c2ad6156c13afdec25ecc6792a9b67b9",
              "status": "affected",
              "version": "634684d79733124f7470b226b0f42aada4426b07",
              "versionType": "git"
            },
            {
              "lessThan": "41b838420457802f21918df66764b6fbf829d330",
              "status": "affected",
              "version": "8c9af478c06bb1ab1422f90d8ecbc53defd44bc3",
              "versionType": "git"
            },
            {
              "lessThan": "418b448e1d7470da9d4d4797f71782595ee69c49",
              "status": "affected",
              "version": "8c9af478c06bb1ab1422f90d8ecbc53defd44bc3",
              "versionType": "git"
            },
            {
              "lessThan": "58ff8064cb4c7eddac4da1a59da039ead586950a",
              "status": "affected",
              "version": "8c9af478c06bb1ab1422f90d8ecbc53defd44bc3",
              "versionType": "git"
            },
            {
              "lessThan": "d0c68045b8b0f3737ed7bd6b8c83b7887014adee",
              "status": "affected",
              "version": "8c9af478c06bb1ab1422f90d8ecbc53defd44bc3",
              "versionType": "git"
            },
            {
              "lessThan": "3079517a5ba80901fe828a06998da64b9b8749be",
              "status": "affected",
              "version": "8c9af478c06bb1ab1422f90d8ecbc53defd44bc3",
              "versionType": "git"
            },
            {
              "lessThan": "6a909ea83f226803ea0e718f6e88613df9234d58",
              "status": "affected",
              "version": "8c9af478c06bb1ab1422f90d8ecbc53defd44bc3",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "24cd31752f47699b89b4b3471155c8e599a1a23a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e9cb474de7ff7a970c2a3951c12ec7e3113c0c35",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "6ab671191f64b0da7d547e2ad4dc199ca7e5b558",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3d9281a4ac7171c808f9507f0937eb236b353905",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0b641b25870f02e2423e494365fc5243cc1e2759",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ffd51dbfd2900e50c71b5c069fe407957e52d61f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "cdd107d7f18158d966c2bc136204fe826dac445c",
              "versionType": "git"
            },
            {
              "lessThan": "5.10.241",
              "status": "affected",
              "version": "5.10.36",
              "versionType": "semver"
            },
            {
              "lessThan": "4.5",
              "status": "affected",
              "version": "4.4.269",
              "versionType": "semver"
            },
            {
              "lessThan": "4.10",
              "status": "affected",
              "version": "4.9.269",
              "versionType": "semver"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.233",
              "versionType": "semver"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.191",
              "versionType": "semver"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.118",
              "versionType": "semver"
            },
            {
              "lessThan": "5.12",
              "status": "affected",
              "version": "5.11.20",
              "versionType": "semver"
            },
            {
              "lessThan": "5.13",
              "status": "affected",
              "version": "5.12.3",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/trace.c",
            "kernel/trace/trace.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.13"
            },
            {
              "lessThan": "5.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.241",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.190",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.149",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.241",
                  "versionStartIncluding": "5.10.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.190",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.149",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.103",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.44",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.4",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.4.269",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.9.269",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.14.233",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.191",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.118",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.11.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.12.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Limit access to parser-\u003ebuffer when trace_get_user failed\n\nWhen the length of the string written to set_ftrace_filter exceeds\nFTRACE_BUFF_MAX, the following KASAN alarm will be triggered:\n\nBUG: KASAN: slab-out-of-bounds in strsep+0x18c/0x1b0\nRead of size 1 at addr ffff0000d00bd5ba by task ash/165\n\nCPU: 1 UID: 0 PID: 165 Comm: ash Not tainted 6.16.0-g6bcdbd62bd56-dirty\nHardware name: linux,dummy-virt (DT)\nCall trace:\n show_stack+0x34/0x50 (C)\n dump_stack_lvl+0xa0/0x158\n print_address_description.constprop.0+0x88/0x398\n print_report+0xb0/0x280\n kasan_report+0xa4/0xf0\n __asan_report_load1_noabort+0x20/0x30\n strsep+0x18c/0x1b0\n ftrace_process_regex.isra.0+0x100/0x2d8\n ftrace_regex_release+0x484/0x618\n __fput+0x364/0xa58\n ____fput+0x28/0x40\n task_work_run+0x154/0x278\n do_notify_resume+0x1f0/0x220\n el0_svc+0xec/0xf0\n el0t_64_sync_handler+0xa0/0xe8\n el0t_64_sync+0x1ac/0x1b0\n\nThe reason is that trace_get_user will fail when processing a string\nlonger than FTRACE_BUFF_MAX, but not set the end of parser-\u003ebuffer to 0.\nThen an OOB access will be triggered in ftrace_regex_release-\u003e\nftrace_process_regex-\u003estrsep-\u003estrpbrk. We can solve this problem by\nlimiting access to parser-\u003ebuffer when trace_get_user failed."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local access to write and then close the tracefs file /sys/kernel/tracing/set_ftrace_filter (or set_ftrace_notrace / set_graph_function); there is no remote or adjacent-network path to trace_get_user().\nAC:L - A single deterministic sequence \u2014 open the filter file, write one token longer than FTRACE_BUFF_MAX (670), close it \u2014 always leaves the parser buffer unterminated and drives strsep() past the allocation; the heap slack that determines how far the over-read runs is itself groomable by the attacker via ordinary kmalloc-1024 spray/free.\nPR:L - The kernel imposes no capability check on ftrace_regex_open/write/release \u2014 access is gated purely by tracefs file permissions, and real deployments grant them to unprivileged users (Android chowns the ftrace filter files to the shell user for \"atrace -k\", and embedded/automotive/ChromeOS images mount tracefs with gid= for a tracing group).\nUI:N - The attacker triggers everything itself; the OOB access happens in ftrace_regex_release() during the attacker\u0027s own close()/exit, with no victim action required.\nS:U - The over-read and NUL over-write stay within kernel slab memory in the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - strpbrk() reads an unbounded amount of heap memory past the 670-byte allocation until it happens to hit a \u0027:\u0027 or NUL, and the bytes it traverses influence the subsequent command strcmp/dispatch, so this is an unbounded out-of-bounds read of adjacent slab objects rather than a strictly bounded few-byte over-read.\nI:H - When the \u0027:\u0027 delimiter is located outside the allocation, strsep() executes *end++ = \u0027\\0\u0027, writing a NUL byte out of bounds into a neighbouring heap object at an offset the attacker can influence through heap grooming \u2014 a classic single-null-byte heap-corruption primitive usable to corrupt adjacent object metadata.\nA:H - The unterminated-string walk produces a KASAN slab-out-of-bounds report (panic under panic_on_warn) and can run off the end of the slab page into unmapped memory, causing a kernel oops; the resulting adjacent-object corruption can also crash the kernel later."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:04:32.439Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b842ef39c2ad6156c13afdec25ecc6792a9b67b9"
        },
        {
          "url": "https://git.kernel.org/stable/c/41b838420457802f21918df66764b6fbf829d330"
        },
        {
          "url": "https://git.kernel.org/stable/c/418b448e1d7470da9d4d4797f71782595ee69c49"
        },
        {
          "url": "https://git.kernel.org/stable/c/58ff8064cb4c7eddac4da1a59da039ead586950a"
        },
        {
          "url": "https://git.kernel.org/stable/c/d0c68045b8b0f3737ed7bd6b8c83b7887014adee"
        },
        {
          "url": "https://git.kernel.org/stable/c/3079517a5ba80901fe828a06998da64b9b8749be"
        },
        {
          "url": "https://git.kernel.org/stable/c/6a909ea83f226803ea0e718f6e88613df9234d58"
        }
      ],
      "title": "tracing: Limit access to parser-\u003ebuffer when trace_get_user failed",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39683",
    "datePublished": "2025-09-05T17:20:49.821Z",
    "dateReserved": "2025-04-16T07:20:57.113Z",
    "dateUpdated": "2026-08-05T12:04:32.439Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-39683",
      "date": "2026-09-16",
      "epss": "0.00179",
      "percentile": "0.07663"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-24T14:45:41.000Z",
      "cve": "CVE-2025-39683",
      "id": "msrc_CVE-2025-39683",
      "initial_release_date": "2025-09-02T00:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "3",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "tracing: Limit access to parser-\u003ebuffer when trace_get_user failed",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-39683.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-39683\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-09-05T18:15:44.810\",\"lastModified\":\"2026-07-30T06:23:39.840\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntracing: Limit access to parser-\u003ebuffer when trace_get_user failed\\n\\nWhen the length of the string written to set_ftrace_filter exceeds\\nFTRACE_BUFF_MAX, the following KASAN alarm will be triggered:\\n\\nBUG: KASAN: slab-out-of-bounds in strsep+0x18c/0x1b0\\nRead of size 1 at addr ffff0000d00bd5ba by task ash/165\\n\\nCPU: 1 UID: 0 PID: 165 Comm: ash Not tainted 6.16.0-g6bcdbd62bd56-dirty\\nHardware name: linux,dummy-virt (DT)\\nCall trace:\\n show_stack+0x34/0x50 (C)\\n dump_stack_lvl+0xa0/0x158\\n print_address_description.constprop.0+0x88/0x398\\n print_report+0xb0/0x280\\n kasan_report+0xa4/0xf0\\n __asan_report_load1_noabort+0x20/0x30\\n strsep+0x18c/0x1b0\\n ftrace_process_regex.isra.0+0x100/0x2d8\\n ftrace_regex_release+0x484/0x618\\n __fput+0x364/0xa58\\n ____fput+0x28/0x40\\n task_work_run+0x154/0x278\\n do_notify_resume+0x1f0/0x220\\n el0_svc+0xec/0xf0\\n el0t_64_sync_handler+0xa0/0xe8\\n el0t_64_sync+0x1ac/0x1b0\\n\\nThe reason is that trace_get_user will fail when processing a string\\nlonger than FTRACE_BUFF_MAX, but not set the end of parser-\u003ebuffer to 0.\\nThen an OOB access will be triggered in ftrace_regex_release-\u003e\\nftrace_process_regex-\u003estrsep-\u003estrpbrk. We can solve this problem by\\nlimiting access to parser-\u003ebuffer when trace_get_user failed.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"kernel/trace/trace.c\",\"kernel/trace/trace.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"634684d79733124f7470b226b0f42aada4426b07\",\"lessThan\":\"b842ef39c2ad6156c13afdec25ecc6792a9b67b9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8c9af478c06bb1ab1422f90d8ecbc53defd44bc3\",\"lessThan\":\"41b838420457802f21918df66764b6fbf829d330\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8c9af478c06bb1ab1422f90d8ecbc53defd44bc3\",\"lessThan\":\"418b448e1d7470da9d4d4797f71782595ee69c49\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8c9af478c06bb1ab1422f90d8ecbc53defd44bc3\",\"lessThan\":\"58ff8064cb4c7eddac4da1a59da039ead586950a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8c9af478c06bb1ab1422f90d8ecbc53defd44bc3\",\"lessThan\":\"d0c68045b8b0f3737ed7bd6b8c83b7887014adee\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8c9af478c06bb1ab1422f90d8ecbc53defd44bc3\",\"lessThan\":\"3079517a5ba80901fe828a06998da64b9b8749be\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8c9af478c06bb1ab1422f90d8ecbc53defd44bc3\",\"lessThan\":\"6a909ea83f226803ea0e718f6e88613df9234d58\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"24cd31752f47699b89b4b3471155c8e599a1a23a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e9cb474de7ff7a970c2a3951c12ec7e3113c0c35\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6ab671191f64b0da7d547e2ad4dc199ca7e5b558\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3d9281a4ac7171c808f9507f0937eb236b353905\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0b641b25870f02e2423e494365fc5243cc1e2759\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ffd51dbfd2900e50c71b5c069fe407957e52d61f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"cdd107d7f18158d966c2bc136204fe826dac445c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5.10.36\",\"lessThan\":\"5.10.241\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.4.269\",\"lessThan\":\"4.5\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.9.269\",\"lessThan\":\"4.10\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.14.233\",\"lessThan\":\"4.15\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.19.191\",\"lessThan\":\"4.20\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.4.118\",\"lessThan\":\"5.5\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.11.20\",\"lessThan\":\"5.12\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.12.3\",\"lessThan\":\"5.13\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"kernel/trace/trace.c\",\"kernel/trace/trace.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.13\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.13\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.241\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.190\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.149\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.103\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.44\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16.4\",\"lessThanOrEqual\":\"6.16.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]},{\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\",\"affectedData\":[{\"vendor\":\"Siemens\",\"product\":\"SIMATIC CN 4100\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"V5.0\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.5\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.5\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.5\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.5\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.5\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.4.269\",\"versionEndExcluding\":\"4.5\",\"matchCriteriaId\":\"1A17D1FB-0B85-43ED-87BE-7BB15922086E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.9.269\",\"versionEndExcluding\":\"4.10\",\"matchCriteriaId\":\"5DA6B5DF-C354-4293-AF20-6294DC3DFAC0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.14.233\",\"versionEndExcluding\":\"4.15\",\"matchCriteriaId\":\"FC28E42D-3C4C-4E0A-A1A4-FB2471BB20B0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.19.191\",\"versionEndExcluding\":\"4.20\",\"matchCriteriaId\":\"FEB61259-1CF1-4791-8D81-F5ED7CEBE348\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.4.118\",\"versionEndExcluding\":\"5.5\",\"matchCriteriaId\":\"D7B7175E-AD40-460B-A504-676A7F85F2BD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.10.36\",\"versionEndExcluding\":\"5.10.241\",\"matchCriteriaId\":\"253602A1-BDF5-4DC3-A3F0-D06592A0F936\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11.20\",\"versionEndExcluding\":\"5.12\",\"matchCriteriaId\":\"CC8679E8-F4E0-4BBF-8682-F0CDCBC99C1E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.12.3\",\"versionEndExcluding\":\"5.15.190\",\"matchCriteriaId\":\"DCD56E21-B3AB-4991-B8CC-53E096B575BC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.149\",\"matchCriteriaId\":\"FDBE8280-8983-4D2D-943D-2E6D0104E2D8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.103\",\"matchCriteriaId\":\"F2293654-7169-49B5-8D0D-EE51EF8B8E48\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.44\",\"matchCriteriaId\":\"12351F24-1133-4775-960C-F2B47E81298B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.16.4\",\"matchCriteriaId\":\"AFC28995-B8C3-4B68-8CB6-78E792B6629D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"327D22EF-390B-454C-BD31-2ED23C998A1C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"C730CD9A-D969-4A8E-9522-162AAF7C0EE9\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA6FEEC2-9F11-4643-8827-749718254FED\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3079517a5ba80901fe828a06998da64b9b8749be\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/418b448e1d7470da9d4d4797f71782595ee69c49\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/41b838420457802f21918df66764b6fbf829d330\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/58ff8064cb4c7eddac4da1a59da039ead586950a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6a909ea83f226803ea0e718f6e88613df9234d58\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b842ef39c2ad6156c13afdec25ecc6792a9b67b9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d0c68045b8b0f3737ed7bd6b8c83b7887014adee\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-032379.html\",\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\"},{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-082556.html\",\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T09:02:06+00:00",
      "cve": "CVE-2025-39683",
      "id": "CVE-2025-39683",
      "initial_release_date": "2025-09-05T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: tracing: Limit access to parser-\u003ebuffer when trace_get_user failed",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-39683.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-11T01:59:22Z",
      "cve": "CVE-2025-39683",
      "id": "CVE-2025-39683",
      "initial_release_date": "2025-09-08T23:22:53Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "660",
      "product_status:known_not_affected": "129",
      "product_status:recommended": "464",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-39683",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-39683.json",
      "version": "52"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.