CVE-2025-22035: Linux Kernel Use-After-Free Vulnerability

CVE-2025-22035 is a use-after-free flaw in the Linux Kernel tracing subsystem that occurs during tracer switching. This vulnerability can be triggered when switching between function_graph and other tracers. This article covers technical details, affected versions, impact, and mitigation strategies.

CVE-2025-22035 Overview

CVE-2025-22035 is a use-after-free vulnerability [CWE-416] in the Linux kernel's ftrace subsystem. The flaw resides in print_graph_function_flags() and is triggered when a user switches the active tracer while another process is concurrently reading the trace file. Switching from the function_graph tracer to another tracer such as timerlat frees iter->private via graph_trace_close() without setting the pointer to NULL. A subsequent call path through event->funcs->trace() then dereferences the stale pointer.

Critical Impact
A local user with access to the tracing interface can trigger memory corruption in kernel space, potentially leading to privilege escalation, kernel crash, or arbitrary code execution.

Affected Products

Linux Kernel (multiple stable branches prior to the fix commits)
Debian distributions referenced in DLA advisories msg00030 and msg00045
Downstream distributions packaging vulnerable kernel versions

Discovery Timeline

2025-04-16 - CVE-2025-22035 published to NVD
2025-11-03 - Last updated in NVD database

Technical Details for CVE-2025-22035

Vulnerability Analysis

The vulnerability is a use-after-free condition in the kernel tracing subsystem. During each s_show() call, print_trace_line() invokes print_graph_function_flags() through two paths: directly via iter->trace->print_line() and indirectly via event->funcs->trace() inside print_trace_fmt(). When a user switches tracers mid-read, only the first path is updated to reflect the new tracer. The second path retains a reference to the previous tracer's print function.

When the previous tracer was function_graph, s_start() calls graph_trace_close() to release iter->private. The pointer itself is never cleared. Subsequent reads then pass the dangling pointer to event->funcs->trace(), producing the use-after-free.

Root Cause

The root cause is a missing pointer invalidation in graph_trace_close(). The function frees memory allocated to iter->private but does not assign NULL to the pointer after release. Combined with stale function pointers cached through the event subsystem during tracer switching, this leaves a window where freed memory is dereferenced by code path that was not synchronized with the tracer change.

Attack Vector

Exploitation requires local access and the ability to write to current_tracer and read from trace under tracefs or debugfs. These interfaces typically require CAP_SYS_ADMIN or root, but they may be exposed to lower-privileged contexts in misconfigured containers or systems with relaxed tracing permissions. The reporter reproduced the issue by enabling function_graph, beginning a cat trace read, then switching to timerlat during the read window. A local attacker who controls execution timing can convert the freed allocation into a controlled object and achieve kernel memory corruption.

No public proof-of-concept exploit has been released, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-22035

Indicators of Compromise

Unexpected kernel oops or panic messages referencing print_graph_function_flags, print_trace_line, or print_trace_fmt in dmesg or /var/log/kern.log
KASAN reports flagging use-after-free in the ftrace code path when kernel address sanitizer is enabled
Non-root or container processes writing to /sys/kernel/tracing/current_tracer or /sys/kernel/debug/tracing/current_tracer

Detection Strategies

Audit access to tracefs and debugfs mount points and alert on unprivileged writes to current_tracer
Enable kernel hardening features such as KASAN in test environments to surface the use-after-free during regression testing
Correlate kernel crash dumps with concurrent reads of the trace file and tracer-switch events

Monitoring Recommendations

Monitor process execution that touches /sys/kernel/tracing/ or /sys/kernel/debug/tracing/ paths and flag non-administrative users
Track kernel version inventory across the fleet to confirm patched builds are deployed
Forward kernel ring buffer events to a centralized logging platform for retroactive analysis of crash patterns

How to Mitigate CVE-2025-22035

Immediate Actions Required

Apply the upstream kernel patches referenced in the stable tree commits, including 099ef33, 42561fe, 70be951, 7f81f27, 81a85b1, a2cce54, c85efe6, de7b309, and f14752d
Update Debian systems using the fixed packages announced in Debian LTS msg00030 and Debian LTS msg00045
Restrict access to tracefs and debugfs to trusted administrators only

Patch Information

The fix sets iter->private to NULL immediately after freeing it in graph_trace_close(), preventing other tracers from dereferencing the released allocation. The patch also removes redundant iter->private = NULL assignments from the wakeup and irqsoff tracers. Refer to the upstream commit 099ef33 and the additional backport commits in the Linux stable tree.

Workarounds

Unmount or restrict tracefs and debugfs where kernel tracing is not required for production workloads
Set restrictive permissions on /sys/kernel/tracing/current_tracer so that only privileged administrators can change the active tracer
Disable container access to host tracing interfaces by removing CAP_SYS_ADMIN and masking /sys/kernel/debug in container runtimes

bash

# Configuration example: restrict tracefs access to root only
mount -o remount,mode=0700 /sys/kernel/tracing
chmod 0600 /sys/kernel/tracing/current_tracer
chmod 0600 /sys/kernel/tracing/trace

# Verify the running kernel includes the fix
uname -r
dpkg -l | grep linux-image   # Debian/Ubuntu
rpm -qa | grep kernel        # RHEL/Fedora