CVE-2025-22035

What it actually does

Use-after-free in print_graph_function_flags during tracer switching: s_start frees iter->private via graph_trace_close but does not NULL it, while print_trace_line performs two calls to the old tracer's print_line and event->funcs->trace, allowing the second path to dereference the freed pointer.

Why it matters to the business

Kernel instability or crashes on systems performing ftrace operations; local attackers could trigger memory corruption. Linux kernel prevalence and downstream package exposure increase operational risk for servers and containers; no KEV listing but related privilege-escalation campaigns noted in ecosystem.

How an attack unfolds

Attacker enables function_graph tracer, starts a concurrent trace reader, then switches to another tracer (e.g., timerlat) while the reader holds a stale private pointer; listed advanced spyware and kernel privilege-escalation campaigns targeting similar Linux issues may chain this UAF for local code execution.

How to fix it

Upgrade Linux kernel to 5.4.292 or apply commit 42561fe62c3628ea3bc9623f64f047605e98857f; update affected Red Hat packages (buildah and debug variants) to 1:1.29.4-1.el9_2.

How to confirm the fix worked

Verify running kernel version >= 5.4.292 or presence of the cited commit; reproduce the original stress script and confirm no UAF in dmesg; check package versions on Red Hat systems.

Typical attack path

1. echo function_graph > current_tracer
2. cat trace > /dev/null &
3. sleep to reach mdelay window in s_start
4. echo <new_tracer> > current_tracer
5. second print path dereferences freed iter->private

How to detect it

Search kernel logs and dmesg for oops or warnings mentioning print_graph_function_flags, graph_trace_close, or use-after-free during tracer switch; correlate with process activity writing to current_tracer.

• print_graph_function_flags
• graph_trace_close
• iter->private
• function_graph to timerlat

What your security team should do

• Prioritize kernel updates on all exposed hosts within 30 days
• Disable unnecessary ftrace tracers in production via sysctl or boot parameters
• Monitor for related kernel oops in centralized logging
• Audit local user access to /sys/kernel/tracing to reduce attack surface