LiveActive security incident?Get immediate response
CVE Record

CVE-2025-38539: tracing: Add down_write(trace_event_sem) when adding trace event

In the Linux kernel, the following vulnerability has been resolved: tracing: Add down_write(trace_event_sem) when adding trace event When a module is loaded, it adds trace events defined by the module. It may also need to modify the modules trace printk formats to replace enum names with their values. If two modules are loaded at the same time, the adding of the event to the ftrace_events list can corrupt the walking of the list in the code that is modifying the printk format strings and crash the kernel. The addition of the event should take the trace_event_sem for write while it adds the new event. Also add a lockdep_assert_held() on that semaphore in __trace_add_event_dirs() as it iterates the list.

HighCVSS 7.8Not KEV-listedUpdated
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A race condition in Linux kernel tracing can corrupt an internal event list when two modules add trace events concurrently, potentially crashing the kernel. A crash can interrupt services and workloads. The supplied CVSS score is 7.8, but the source bundle does not establish remote reachability or observed attacks.

Executive priority

Schedule prompt remediation through normal high-severity kernel maintenance, prioritizing availability-sensitive servers and systems that dynamically load modules. Emergency internet-edge action is not supported by the evidence because the issue is local and no active exploitation is cited.

Technical view

Concurrent module loading can add events to the ftrace_events list while trace printk formats are walking that list. Missing write locking on trace_event_sem permits list corruption. The kernel fix takes the semaphore for writing during event addition and adds a lock assertion in __trace_add_event_dirs().

Likely exposure

Exposure is limited to Linux systems running affected kernel builds where modules defining trace events may load concurrently. The supplied version data is ambiguous and should not be treated as complete range guidance. Confirm exposure using distribution advisories and exact installed kernel package versions.

Exploitation context

The supplied vector describes a local, low-complexity condition requiring low privileges and no user interaction. However, the described trigger involves concurrent module loading, and the sources do not explain how an unprivileged user reaches it. CISA KEV status is false, with no cited evidence of active exploitation.

Researcher notes

The key defect is missing write-side serialization around mutation of ftrace_events during concurrent trace-format traversal. The security impact beyond a kernel crash is not demonstrated in the description, despite the CVSS vector rating confidentiality, integrity, and availability high. Version boundaries require vendor confirmation.

Mitigation direction

  • Install the applicable vendor or distribution kernel update containing the referenced locking fix.
  • Reboot into the updated kernel after installation.
  • Check vendor guidance for affected-version boundaries and any distribution-specific mitigations.
  • Prioritize systems where dynamic module loading and availability are operationally important.

Validation and detection

  • Inventory running kernel versions and distribution package revisions.
  • Compare exact packages against vendor advisories and referenced stable-kernel fixes.
  • Confirm the running kernel changed after updating and rebooting.
  • Review kernel logs for tracing-related list corruption, crashes, or concurrent module-load failures.
Prepared
Confidence
medium
Sources
12

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-38539 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
1ADP providers
11Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2025-38539Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux110bf2b764eb6026b868d84499263cb24b1bcc8d, 110bf2b764eb6026b868d84499263cb24b1bcc8d, 110bf2b764eb6026b868d84499263cb24b1bcc8d, 110bf2b764eb6026b868d84499263cb24b1bcc8d, 110bf2b764eb6026b868d84499263cb24b1bcc8d, 110bf2b764eb6026b868d84499263cb24b1bcc8d, 110bf2b764eb6026b868d84499263cb24b1bcc8d, 110bf2b764eb6026b868d84499263cb24b1bcc8dunaffected
LinuxLinux2.6.31, 0, 5.4.297, 5.10.241, 5.15.190, 6.1.147, 6.6.100, 6.12.40, 6.15.8, 6.16affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.