CVE-2025-38131

What it actually does

Race condition between cscfg_csdev_enable_active_config and sysfs-driven config deactivation allows module unload while a reference to config_desc remains, resulting in use-after-free on subsequent access in cscfg_csdev_enable_config.

Why it matters to the business

Kernel instability, crashes, or potential privilege escalation on Linux systems using coresight tracing, affecting device availability and security posture until patched.

How an attack unfolds

An attacker with sysfs access activates a config on one CPU while another CPU concurrently enables the active config; deactivation then unloads the module, freeing config_desc which is later dereferenced, producing a use-after-free. Listed threat actors associated with similar Linux kernel privilege-escalation campaigns may leverage this pattern.

How to fix it

Update the Linux kernel to commit dfe8224c9c7a43d356eb9f74b06868aa05f90223 or later, which introduces active_cnt reference counting to keep the module loaded while the config is enabled.

How to confirm the fix worked

Confirm the patch is present by checking that cscfg_config_desc active_cnt is incremented on activate/enable and decremented only when the count reaches zero before module unload; test by exercising concurrent enable/deactivate paths.

Typical attack path

1. Obtain sysfs access to coresight configfs interface
2. Activate config to increment sys_active_cnt
3. Trigger concurrent cscfg_csdev_enable_active_config on another CPU
4. Deactivate config and unload module while reference is still held
5. Access freed config_desc structure to trigger UAF

How to detect it

Review kernel logs for coresight-related oops/panics mentioning config_desc or cscfg_unload_config_sets; correlate with sysfs config activation/deactivation timestamps and unexpected module unload events.

What your security team should do

• Apply the referenced kernel commit immediately on all affected systems
• Restrict unprivileged sysfs access to coresight configfs where feasible
• Monitor EPSS trend and threat-actor activity for similar kernel UAFs
• Reboot systems after patching to ensure new kernel is running