CVE-2025-38346

A flaw was found in the Linux kernel's Function Tracer (ftrace) subsystem. When an internal error disables function tracing and a kernel module is subsequently removed, the kernel fails to properly release tracking references associated with the unloaded module. A local user querying the kernel symbol table can trigger a use-after-free condition by accessing this deallocated memory, leading to a system crash and causing a Denial of Service (DoS).

This vulnerability is rated as Moderate impact for Red Hat Enterprise Linux because triggering the condition requires an unusual combination of an active kernel tracing failure and privileged module unloading, limiting the overall impact to a local denial of service. If an error disables function tracing and a kernel module is subsequently removed, unreleased tracking references allow local users querying kernel symbol tables to access deallocated memory and induce a system crash. Exploitation does not allow privilege escalation or data exposure, and normal operational environments rarely encounter the requisite tracer fault state.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.