CyberSecBulletin
CVE-2025-22035NVD status: Modified

Linux: Use After Free

Published Updated By the CyberSecBulletin desk

CVE-2025-22035 is a high-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 42561fe62c3628ea3bc9623f64f047605e98857f, de7b309139f862a44379ecd96e93c9133c69f813, 81a85b12132c8ffe98f5ddbdc185481790aeaa1b as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.31% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 42561fe62c3628ea3bc9623f64f047605e98857f or de7b309139f862a44379ecd96e93c9133c69f813 or 81a85b12132c8ffe98f5ddbdc185481790aeaa1b or a2cce54c1748216535dda02e185d07a084be837e, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 4.15 or 4.20 or 5.4.292 or 5.10.236, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux05319d707732c728eb721ac616a50e7978eb499a up to, but not including, 42561fe62c3628ea3bc9623f64f047605e98857f; b8205dfed68183dc1470e83863c5ded6d7fa30a9 up to, but not including, de7b309139f862a44379ecd96e93c9133c69f813; ce6e2b14bc094866d9173db6935da2d752f06d8b up to, but not including, 81a85b12132c8ffe98f5ddbdc185481790aeaa1b; 2cb0c037c927db4ec928cc927488e52aa359786e up to, but not including, a2cce54c1748216535dda02e185d07a084be837e; eecb91b9f98d6427d4af5fdb8f108f52572a39e7 up to, but not including, 099ef3385800828b74933a96c117574637c3fb3a; eecb91b9f98d6427d4af5fdb8f108f52572a39e7 up to, but not including, c85efe6e13743cac6ba4ccf144cb91f44c86231a; eecb91b9f98d6427d4af5fdb8f108f52572a39e7 up to, but not including, f14752d66056d0c7bffe5092130409417d3baa70; eecb91b9f98d6427d4af5fdb8f108f52572a39e7 up to, but not including, 70be951bc01e4a0e10d443f3510bb17426f257fb; and 12 more ranges42561fe62c3628ea3bc9623f64f047605e98857f, de7b309139f862a44379ecd96e93c9133c69f813, 81a85b12132c8ffe98f5ddbdc185481790aeaa1b, a2cce54c1748216535dda02e185d07a084be837e, 099ef3385800828b74933a96c117574637c3fb3a, c85efe6e13743cac6ba4ccf144cb91f44c86231a
LinuxLinux Kernel4.14.324 up to, but not including, 4.15; 4.19.293 up to, but not including, 4.20; 5.4.255 up to, but not including, 5.4.292; 5.10.193 up to, but not including, 5.10.236; 5.15.129 up to, but not including, 5.15.180; 6.1.50 up to, but not including, 6.1.134; 6.4.13 up to, but not including, 6.6.87; 6.7 up to, but not including, 6.12.23; and 2 more ranges4.15, 4.20, 5.4.292, 5.10.236, 5.15.180, 6.1.134

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CISA (ADP).

Official description

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free in print_graph_function_flags during tracer switching Kairui reported a UAF issue in print_graph_function_flags() during ftrace stress testing [1]. This issue can be reproduced if puting a 'mdelay(10)' after 'mutex_unlock(&trace_types_lock)' in s_start(), and executing the following script: $ echo function_graph > current_tracer $ cat trace > /dev/null & $ sleep 5 # Ensure the 'cat' reaches the 'mdelay(10)' point $ echo timerlat > current_tracer The root cause lies in the two calls to print_graph_function_flags within print_trace_line during each s_show(): * One through 'iter->trace->print_line()'; * Another through 'event->funcs->trace()', which is hidden in print_trace_fmt() before print_trace_line returns. Tracer switching only updates the former, while the latter continues to use the print_line function of the old tracer, which in the script above is print_graph_function_flags. Moreover, when switching from the 'function_graph' tracer to the 'timerlat' tracer, s_start only calls graph_trace_close of the 'function_graph' tracer to free 'iter->private', but does not set it to NULL. This provides an opportunity for 'event->funcs->trace()' to use an invalid 'iter->private'. To fix this issue, set 'iter->private' to NULL immediately after freeing it in graph_trace_close(), ensuring that an invalid pointer is not passed to other tracers. Additionally, clean up the unnecessary 'iter->private = NULL' during each 'cat trace' when using wakeup and irqsoff tracers. [1] https://lore.kernel.org/all/[email protected]/

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.

How developers prevent this class of flaw

  • Choose a language that provides automatic memory management.
  • When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.

More Use After Free vulnerabilities (CWE-416)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Use After Free vulnerabilities

Spotted an error? Tell us.