Cloudanix VulnDB

CVE-2025-37940

None

CVSS

—

EPSS

0.2%

Published

May 20, 2025

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A tracing feature inside older Linux kernels could freeze the system when asked to track too many functions at once.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Denial of service
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Missing cond_resched() call inside the loop of ftrace_graph_set_hash() allows prolonged execution without yielding the CPU when tracing a large number of functions, triggering the softlockup watchdog.

Why it matters to the business

Older Ubuntu kernel deployments may experience kernel softlockups or system unresponsiveness during ftrace configuration on systems with extensive traceable functions, increasing operational risk for workloads relying on function graph tracing.

How an attack unfolds

An attacker with root privileges configures ftrace function graph tracing to include a large set of functions; the kernel then executes the unprotected loop in ftrace_graph_set_hash(), consuming CPU time until the softlockup watchdog fires and the system becomes unresponsive.

How to fix it

Upgrade affected packages to the listed fixed versions: linux 3.11.0-12.19 (14.04), 4.4.0-2.16 (16.04), 4.13.0-16.19 (18.04), 5.4.0-9.12 (20.04) and equivalent updates for linux-aws, linux-azure, linux-gcp, linux-hwe, linux-kvm, linux-oracle and related meta-packages.

How to confirm the fix worked

Verify running kernel version matches or exceeds the per-package fixed versions; inspect kernel source for presence of cond_resched() inside ftrace_graph_set_hash(); confirm absence of softlockup messages during ftrace operations.

Typical attack path

  1. Obtain root or CAP_SYS_ADMIN privileges on the target system
  2. Enable function graph tracing via ftrace interface with a broad function set
  3. Invoke ftrace_graph_set_hash() to populate the hash table
  4. Trigger softlockup watchdog through sustained non-preemptible execution

How to detect it

Search kernel logs and dmesg for softlockup watchdog messages containing references to ftrace_graph_set_hash or ftrace function iteration; correlate with ftrace configuration changes in audit logs.

  • BUG: soft lockup - CPU
  • ftrace_graph_set_hash
  • NMI watchdog: Watchdog detected hard LOCKUP

What your security team should do

  • Apply the exact fixed kernel packages immediately on all listed Ubuntu releases
  • Audit systems for active ftrace function-graph configurations
  • Monitor dmesg and kernel logs for softlockup events involving ftrace
  • Restrict ftrace access to trusted administrators only

The record

In the Linux kernel, the following vulnerability has been resolved: ftrace: Add cond_resched() to ftrace_graph_set_hash() When the kernel contains a large number of functions that can be traced, the loop in ftrace_graph_set_hash() may take a lot of time to execute. This may trigger the softlockup watchdog. Add cond_resched() within the loop to allow the kernel to remain responsive even when processing a large number of functions. This matches the cond_resched() that is used in other locations of the code that iterates over all functions that can be traced.

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 linux 0 5.10.237-1
Debian:11 linux-6.1 0 6.1.137-1~deb11u1
Debian:12 linux 0 6.1.135-1
Debian:13 linux 0 6.12.25-1
Linux Kernel 4.11.0 5.4.293

Related vulnerabilities