CVE-2025-40021

A missing security check was found in the Linux kernel's tracing subsystem in the dynamic events interface on tracefs. A local user can bypass kernel lockdown restrictions by using the dynamic_events interface to create kprobes or uprobes, since this interface lacks the lockdown validation present in the equivalent kprobe_events and uprobe_events interfaces. This allows unauthorized modification of kernel tracing state on systems where lockdown should prevent such operations.

Kernel lockdown is a security feature that restricts certain operations when the system is in a secured state, such as when Secure Boot is enabled. The kprobe_events and uprobe_events tracefs interfaces properly check lockdown status before allowing probe creation, but the dynamic_events interface provides equivalent functionality without this check. An attacker on a lockdown-enabled system could use dynamic_events to attach probes that would otherwise be blocked, potentially enabling kernel inspection or tampering that lockdown was meant to prevent. Exploitation requires local access to tracefs, which typically requires root or membership in the tracing group.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.