CVE-2025-38539: tracing: Add down_write(trace_event_sem) when adding trace event
In the Linux kernel, the following vulnerability has been resolved:
tracing: Add down_write(trace_event_sem) when adding trace event
When a module is loaded, it adds trace events defined by the module. It
may also need to modify the modules trace printk formats to replace enum
names with their values.
If two modules are loaded at the same time, the adding of the event to the
ftrace_events list can corrupt the walking of the list in the code that is
modifying the printk format strings and crash the kernel.
The addition of the event should take the trace_event_sem for write while
it adds the new event.
Also add a lockdep_assert_held() on that semaphore in
__trace_add_event_dirs() as it iterates the list.
Security readout for executives and security teams
Plain-English summary
A race condition in Linux kernel tracing can corrupt an internal event list when two modules add trace events concurrently, potentially crashing the kernel. A crash can interrupt services and workloads. The supplied CVSS score is 7.8, but the source bundle does not establish remote reachability or observed attacks.
Executive priority
Schedule prompt remediation through normal high-severity kernel maintenance, prioritizing availability-sensitive servers and systems that dynamically load modules. Emergency internet-edge action is not supported by the evidence because the issue is local and no active exploitation is cited.
Technical view
Concurrent module loading can add events to the ftrace_events list while trace printk formats are walking that list. Missing write locking on trace_event_sem permits list corruption. The kernel fix takes the semaphore for writing during event addition and adds a lock assertion in __trace_add_event_dirs().
Likely exposure
Exposure is limited to Linux systems running affected kernel builds where modules defining trace events may load concurrently. The supplied version data is ambiguous and should not be treated as complete range guidance. Confirm exposure using distribution advisories and exact installed kernel package versions.
Exploitation context
The supplied vector describes a local, low-complexity condition requiring low privileges and no user interaction. However, the described trigger involves concurrent module loading, and the sources do not explain how an unprivileged user reaches it. CISA KEV status is false, with no cited evidence of active exploitation.
Researcher notes
The key defect is missing write-side serialization around mutation of ftrace_events during concurrent trace-format traversal. The security impact beyond a kernel crash is not demonstrated in the description, despite the CVSS vector rating confidentiality, integrity, and availability high. Version boundaries require vendor confirmation.
Mitigation direction
Install the applicable vendor or distribution kernel update containing the referenced locking fix.
Reboot into the updated kernel after installation.
Check vendor guidance for affected-version boundaries and any distribution-specific mitigations.
Prioritize systems where dynamic module loading and availability are operationally important.
Validation and detection
Inventory running kernel versions and distribution package revisions.
Compare exact packages against vendor advisories and referenced stable-kernel fixes.
Confirm the running kernel changed after updating and rebooting.
Review kernel logs for tracing-related list corruption, crashes, or concurrent module-load failures.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2025-38539 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
1CVSS vectors
3Timeline events
1ADP providers
11Source links
CVSS vector scores
1 official score
We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.