cbcvebase.
CVE-2025-21899
published 2025-04-01

CVE-2025-21899: In the Linux kernel, the following vulnerability has been resolved: tracing: Fix bad hist from corrupting named_triggers list The following commands causes a…

PriorityP421medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.20%
10.0th percentile
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix bad hist from corrupting named_triggers list The following commands causes a crash: ~# cd /sys/kernel/tracing/events/rcu/rcu_callback ~# echo 'hist:name=bad:keys=common_pid:onmax(bogus).save(common_pid)' > trigger bash: echo: write error: Invalid argument ~# echo 'hist:name=bad:keys=common_pid' > trigger Because the following occurs: event_trigger_write() { trigger_process_regex() { event_hist_trigger_parse() { data = event_trigger_alloc(..); event_trigger_register(.., data) { cmd_ops->reg(.., data, ..) [hist_register_trigger()] { data->ops->init() [event_hist_trigger_init()] { save_named_trigger(name, data) { list_add(&data->named_list, &named_triggers); } } } } ret = create_actions(); (return -EINVAL) if (ret) goto out_unreg; [..] ret = hist_trigger_enable(data, ...) { list_add_tail_rcu(&data->list, &file->triggers); unreg(.., data, ..) [hist_unregister_trigger()] { list_for_each_entry(iter, &file->triggers, list) { if (!hist_trigger_match(data, iter, named_data, false)) ops->free) ops->free(test) [event_hist_trigger_free()] { [..] if (data->name) del_named_trigger(data) { list_del(&data->named_list); triggers to be properly populated.

Affected

23 ranges
VendorProductVersion rangeFixed in
debianlinux< linux 6.1.133-1 (bookworm)linux 6.1.133-1 (bookworm)
debianlinux-6.1< linux 6.1.133-1 (bookworm)linux 6.1.133-1 (bookworm)
linuxlinux
linuxlinux>= 067fe038e70f6e64960d26a79c4df5f1413d0f13 < 5ae1b18f05ee2b849dc03b6c15d7da0c1c6efa775ae1b18f05ee2b849dc03b6c15d7da0c1c6efa77
linuxlinux>= 067fe038e70f6e64960d26a79c4df5f1413d0f13 < 43b254d46c740bf9dbe65709afa021dd726dfa9943b254d46c740bf9dbe65709afa021dd726dfa99
linuxlinux>= 067fe038e70f6e64960d26a79c4df5f1413d0f13 < 435d2964af815aae456db554c62963b4515f19d0435d2964af815aae456db554c62963b4515f19d0
linuxlinux>= 067fe038e70f6e64960d26a79c4df5f1413d0f13 < f1ae50cfb818ce1ac7a674406dfadb7653e2552df1ae50cfb818ce1ac7a674406dfadb7653e2552d
linuxlinux>= 067fe038e70f6e64960d26a79c4df5f1413d0f13 < 6f86bdeab633a56d5c6dccf1a2c5989b6a5e323e6f86bdeab633a56d5c6dccf1a2c5989b6a5e323e
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel>= 0 < 6.1.133-16.1.133-1
linuxlinux_kernel>= 0 < 6.12.19-16.12.19-1
linuxlinux_kernel>= 0 < 6.12.19-16.12.19-1
linuxlinux_kernel>= 0 < 6.8.0-84.846.8.0-84.84
linuxlinux_kernel>= 4.17 < 6.1.1306.1.130
linuxlinux_kernel>= 6.13 < 6.13.66.13.6
linuxlinux_kernel>= 6.2 < 6.6.816.6.81
linuxlinux_kernel>= 6.7 < 6.12.186.12.18
msrccbl2_kernel_5.15.186.1-1_on_cbl_mariner_2.0
msrccbl2_kernel_5.15.200.1-1_on_cbl_mariner_2.0
msrccbl2_kernel_5.15.202.1-1_on_cbl_mariner_2.0

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_msrc5.5MEDIUM
vendor_redhat5.5MEDIUM
vendor_ubuntu5.5MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.