Security readout for executives and security teams
Plain-English summary
A Linux kernel tracing flaw can cause the kernel to read beyond an allocated buffer when an overly long tracing filter is submitted. The attack is local, not directly network-reachable. The 7.8 score indicates potentially serious consequences, but the supplied evidence demonstrates an out-of-bounds read, not a working privilege-escalation exploit.
Executive priority
Treat this as high-priority kernel maintenance, especially where less-trusted local users or processes can access tracing. Accelerate vendor updates, but current evidence does not support describing it as an actively exploited remote emergency.
Technical view
When trace_get_user rejects input longer than FTRACE_BUFF_MAX, parser->buffer is not terminated. ftrace_regex_release later processes it through ftrace_process_regex and strsep/strpbrk, causing a KASAN-observed one-byte slab out-of-bounds read. Upstream fixes limit buffer access following the failure. The supplied CVSS vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Likely exposure
Exposure requires vulnerable Linux tracing code and a local actor able to write an oversized string to set_ftrace_filter. The CVSS vector specifies low privileges, but the supplied crash involved UID 0; practical reach therefore depends on tracing permissions and configuration. The bundle's version mapping is ambiguous, so confirm exposure against distributor guidance and applicable fix commits.
Exploitation context
KEV is false, and the bundle provides no evidence of active exploitation or a public exploit. It documents a KASAN-detected slab out-of-bounds read during cleanup after an oversized filter write. Practical exploitation beyond the demonstrated memory-safety violation is not established by the supplied sources.
Researcher notes
The failure path is central: oversized input makes trace_get_user fail without terminating parser->buffer, and release-time parsing reads beyond the slab. KASAN confirms an out-of-bounds read. No CWE is supplied, and the sources do not establish code execution, privilege escalation, or reliable denial of service. Resolve version applicability per distribution branch.
Mitigation direction
- Apply a vendor-provided kernel update containing the applicable stable fix for your kernel branch.
- Consult the Linux distributor or device vendor for corrected packages and branch-specific guidance.
- Prioritize systems where less-trusted local users or processes can access kernel tracing controls.
Validation and detection
- Inventory running kernel builds and identify systems potentially matching the bundle's affected entries.
- Compare each build with its distributor advisory and the applicable upstream stable fix commit.
- Review who can access set_ftrace_filter and other relevant tracing controls.
- After updating, confirm the corrected kernel build is running using vendor-supported verification procedures.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-39683 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/b842ef39c2ad6156c13afdec25ecc6792a9b67b9CVE reference, Linux
- https://git.kernel.org/stable/c/41b838420457802f21918df66764b6fbf829d330CVE reference, Linux
- https://git.kernel.org/stable/c/418b448e1d7470da9d4d4797f71782595ee69c49CVE reference, Linux
- https://git.kernel.org/stable/c/58ff8064cb4c7eddac4da1a59da039ead586950aCVE reference, Linux
- https://git.kernel.org/stable/c/d0c68045b8b0f3737ed7bd6b8c83b7887014adeeCVE reference, Linux
- https://git.kernel.org/stable/c/3079517a5ba80901fe828a06998da64b9b8749beCVE reference, Linux
- https://git.kernel.org/stable/c/6a909ea83f226803ea0e718f6e88613df9234d58CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.htmlCVE reference, CVE
- https://cert-portal.siemens.com/productcert/html/ssa-082556.htmlCVE reference, siemens-SADP
- https://cert-portal.siemens.com/productcert/html/ssa-032379.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.