CVE-2025-37938

What it actually does

The trace event format verifier skips checks on "%*p.." specifiers, allowing event formats that reference freed memory to pass validation and trigger use-after-free reads during tracing.

Why it matters to the business

Unpatched systems on affected Ubuntu releases may experience kernel crashes during tracing or module load, leading to downtime and potential privilege escalation in environments running older kernels; high downstream prevalence across Ubuntu LTS lines increases exposure for organizations still on 14.04/16.04/18.04/20.04 variants.

How an attack unfolds

An attacker with the ability to load a malicious or specially crafted trace event module triggers the verifier at module load; because the "%*p.." case is ignored, an unsafe pointer format reaches runtime, dereferencing freed memory and causing a crash or controlled read that can be chained into privilege escalation by threat actors observed exploiting similar Linux kernel issues.

How to fix it

Upgrade each affected package to the listed fixed version: linux (14.04) to 3.11.0-12.19, linux-aws (14.04) to 4.4.0-1002.2, linux-azure (14.04) to 4.15.0-1023.24~14.04.1, linux-lts-xenial (14.04) to 4.4.0-13.29~14.04.1, linux (16.04) to 4.4.0-2.16, linux-aws (16.04) to 4.4.0-1001.10, linux-azure (16.04) to 4.11.0-1009.9, linux-gcp (16.04) to 4.10.0-1004.4, linux-hwe (16.04) to 4.8.0-39.42~16.04.1, linux-kvm (16.04) to 4.4.0-1004.9, linux-aws-hwe (16.04) to 4.15.0-1030.31~16.04.1, linux-oracle (16.04) to 4.15.0-1007.9~16.04.1, linux (18.04) to 4.13.0-16.19, linux-aws (18.04) to 4.15.0-1001.1, linux-kvm (18.04) to 4.15.0-1002.2, linux-oracle (18.04) to 4.15.0-1007.9, linux-hwe-edge (18.04) to 5.0.0-15.16~18.04.1, linux (20.04) to 5.4.0-9.12, linux-aws (20.04) to 5.4.0-1005.5; reboot after upgrade and verify the new kernel is running.

How to confirm the fix worked

After patching, confirm the running kernel version matches one of the fixed releases above; trigger trace event loading and verify no verifier warnings or crashes occur for formats containing "%*p.."; re-run the trace event verifier logic manually if possible.

Typical attack path

1. Identify or load a trace event using a print format containing "%*p.." specifier
2. Verifier at boot or module load skips safety checks for the format
3. Event triggers and dereferences a pointer to memory freed after allocation
4. Resulting use-after-free read produces kernel panic or information leak usable for further exploitation

How to detect it

Review kernel logs (dmesg, /var/log/kern.log) around boot and module load times for oops or panic messages referencing trace event formats or use-after-free reads; look for unexpected crashes coinciding with trace event registration in environments using custom trace modules.

What your security team should do

• Prioritize patching of internet-facing or high-value systems on the listed Ubuntu releases within the next maintenance window
• Inventory all systems still running the affected kernel packages and schedule upgrades before any tracing or debugging workloads
• Monitor EPSS trend and threat actor activity around similar Linux kernel issues for potential increase in exploit maturity
• Disable unnecessary tracing features on legacy kernels until patches can be applied