CVE-2025-22035: Linux Kernel Use-After-Free Vulnerability

CVE-2025-22035 Overview

CVE-2025-22035 is a Use After Free (UAF) vulnerability in the Linux kernel's tracing subsystem, specifically within the print_graph_function_flags() function during tracer switching operations. This memory corruption vulnerability occurs when switching between tracers (such as from function_graph to timerlat), where the iter->private pointer is freed but not set to NULL, allowing subsequent tracer operations to access invalid memory.

Critical Impact

Local attackers with low privileges can exploit this vulnerability to potentially achieve arbitrary code execution, data corruption, or system crashes through use-after-free memory access in kernel space.

Affected Products

• Linux Kernel (multiple versions)
• Systems running ftrace and function graph tracing
• Debian Linux (see LTS advisories)

Discovery Timeline

• April 16, 2025 - CVE-2025-22035 published to NVD
• November 3, 2025 - Last updated in NVD database

Technical Details for CVE-2025-22035

Vulnerability Analysis

This vulnerability exists in the Linux kernel's ftrace tracing infrastructure, specifically in how tracer switching is handled. The issue was identified during ftrace stress testing and involves the print_graph_function_flags() function being called with freed memory.

During normal operation, when the function_graph tracer is active and a user reads from the trace file, print_trace_line() makes two calls to print_graph_function_flags():

1. Through iter->trace->print_line() - the direct tracer callback
2. Through event->funcs->trace() within print_trace_fmt() - the event-specific trace function

When switching tracers, only the first call path is updated to use the new tracer's print function. The second path continues to reference the old tracer's function. Furthermore, when transitioning from function_graph to another tracer like timerlat, the graph_trace_close() function frees iter->private but fails to set the pointer to NULL, creating a dangling pointer that can be dereferenced by the old tracer's still-active event functions.

Root Cause

The root cause is a failure to properly invalidate the iter->private pointer after freeing the associated memory in graph_trace_close(). This violates the safe memory management principle that freed pointers should immediately be set to NULL to prevent use-after-free conditions.

The fix involves setting iter->private to NULL immediately after freeing it in graph_trace_close(), ensuring that any subsequent access through stale function pointers will encounter a NULL check rather than accessing freed memory. Additionally, the patch cleans up unnecessary iter->private = NULL assignments during cat trace operations when using wakeup and irqsoff tracers.

Attack Vector

The vulnerability requires local access and can be exploited by a user with the ability to manipulate the ftrace tracing interface. An attacker would need to:

1. Enable the function_graph tracer by writing to /sys/kernel/debug/tracing/current_tracer
2. Start a process reading from the trace file (cat trace)
3. Time a tracer switch operation to occur while the read is in progress
4. The race condition window between freeing iter->private and accessing it through event functions allows the use-after-free to occur

The exploitation scenario described involves introducing a delay (such as mdelay(10)) after the mutex_unlock(&trace_types_lock) in s_start(), then executing a script that switches from function_graph to timerlat while a trace read is in progress.

Detection Methods for CVE-2025-22035

Indicators of Compromise

• Kernel oops or panic messages referencing print_graph_function_flags or print_trace_line
• KASAN (Kernel Address Sanitizer) reports indicating use-after-free in the tracing subsystem
• Unexpected system crashes during ftrace operations or tracer switching
• Memory corruption symptoms following tracing configuration changes

Detection Strategies

• Enable KASAN in kernel builds to detect use-after-free memory access violations
• Monitor kernel logs for stack traces involving print_graph_function_flags, print_trace_fmt, or s_show
• Deploy kernel memory debugging tools to identify dangling pointer dereferences
• Audit systems for unusual ftrace activity or rapid tracer switching patterns

Monitoring Recommendations

• Implement kernel log monitoring for tracing subsystem errors and warnings
• Use SentinelOne's kernel-level monitoring to detect anomalous memory access patterns
• Configure alerts for repeated kernel crashes or oops events in tracing-related code paths
• Monitor access patterns to /sys/kernel/debug/tracing/ interfaces for suspicious activity

How to Mitigate CVE-2025-22035

Immediate Actions Required

• Update the Linux kernel to a patched version that includes the fix for this vulnerability
• Restrict access to the tracing debugfs interface (/sys/kernel/debug/tracing/) to trusted administrators only
• Consider disabling ftrace functionality on production systems where it is not required
• Apply available distribution-specific security patches from vendors such as Debian

Patch Information

The vulnerability has been addressed through multiple kernel commits that set iter->private to NULL after freeing it in graph_trace_close(). The following patches are available:

• Linux Kernel Commit 099ef33
• Linux Kernel Commit 42561fe
• Linux Kernel Commit 70be951
• Linux Kernel Commit 7f81f27
• Linux Kernel Commit 81a85b1

Additional distribution advisories are available from Debian LTS.

Workarounds

• Restrict access to /sys/kernel/debug/tracing/ using filesystem permissions (chmod 700)
• Disable the function_graph tracer if not required for system operations
• Implement SELinux or AppArmor policies to limit access to debugfs tracing interfaces
• Avoid switching tracers while trace files are being actively read

# Restrict tracing interface access
chmod 700 /sys/kernel/debug/tracing/
chown root:root /sys/kernel/debug/tracing/

# Disable function_graph tracer as a workaround
echo nop > /sys/kernel/debug/tracing/current_tracer