CVE-2025-39689

A flaw was found in the Linux kernel. A Use-After-Free (UAF) vulnerability exists in the ftrace subsystem during the reading of tracing filter files. The filter reader retains a direct pointer to global filter data rather than creating an independent copy, which allows concurrent updates to free the underlying memory while it is still referenced. A local attacker can exploit this flaw to cause a Denial of Service (DoS) through a system crash or potentially achieve privilege escalation.

A use-after-free flaw was found in the Linux kernel's ftrace subsystem, rated by Red Hat as Moderate severity. It affects the kernel and kernel-rt packages in Red Hat Enterprise Linux 8, 9, and 10 and the kernel package in Red Hat In-Vehicle OS 1. When reading the set_ftrace_filter or set_ftrace_notrace tracing files, the reader keeps a direct pointer to the global tracer hash instead of an allocated copy, so a concurrent update that releases the locks protecting the global tracer hashes can free the underlying memory while it is still referenced. A local attacker with the elevated privileges required to access the ftrace tracing files could exploit this use-after-free to cause a denial of service (system crash) or potentially escalate privileges. Red Hat Enterprise Linux 7 is not affected because the vulnerable code is not present in that stream. A fix for the affected streams is currently deferred, so the flaw remains unresolved in those products; the residual risk is limited because exploitation requires local access with elevated privileges to the tracing subsystem. Red Hat scored this flaw Moderate (CVSS 6.4) rather than the High severity (7.8) assigned by NIST and CVE.org because accessing the ftrace filter files requires elevated privileges, which significantly reduces the attack exposure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.