CVE-2025-22046

What it actually does

The flaw permits a uretprobe syscall trampoline check to accept addresses near the bottom of the address space when uretprobes are not configured, bypassing intended validation.

Why it matters to the business

Linux systems using uprobes face a low-probability risk of unauthorized syscall invocation, potentially enabling limited local privilege escalation or stability issues; low urgency given absence from KEV and static low EPSS over 560 days since publication.

How an attack unfolds

An attacker with local access crafts a scenario where trampoline_check_ip returns a low address allowed by mmap minimums, then invokes the uretprobe syscall without active probes to bypass the hardened check and execute unintended code paths.

How to fix it

Apply the kernel fix from commit c35771342e47d58ab9433f3be1c3c30f2c5fa4f3 or update affected packages such as libsoup to 2.72.0-8.el9_4.1 on RHEL 9.4 EUS.

How to confirm the fix worked

Confirm the presence of commit c35771342e47d58ab9433f3be1c3c30f2c5fa4f3 in the running kernel source or verify package versions match the fixed releases for libsoup components.

Typical attack path

1. Obtain local execution context on an affected Linux kernel
2. Configure or trigger uprobe-related syscall paths
3. Supply input that causes trampoline_check_ip to evaluate a low address
4. Invoke uretprobe syscall before probes are active to bypass validation

How to detect it

Examine kernel logs for uretprobe or uprobe syscall anomalies and review process activity involving low-address mappings or trampoline setups prior to the fix date.

What your security team should do

• Prioritize kernel updates containing the trampoline hardening on all systems using uprobes
• Review and restrict mmap minimum address configurations where feasible
• Monitor upstream kernel changelogs for related uprobe changes