CVE-2025-38493

What it actually does

A missing initialization of the size field before memcpy in __timerlat_dump_stack allows FORTIFY_SOURCE to detect a zero-sized buffer write from uninitialized ringbuffer data, triggering a kernel panic.

Why it matters to the business

Linux systems running timerlat tracing with stack saving can suffer sudden kernel panics leading to crashes, service interruptions, and potential loss of in-progress work.

How an attack unfolds

An attacker with local access enables timerlat tracing with stack saving, causes the ringbuffer to supply a zero size value, and triggers the uninitialized memcpy that panics the kernel; listed threat actors have been observed chaining similar kernel memory issues for privilege escalation.

How to fix it

Upgrade the Linux kernel to a version containing the fix that populates the size field before the memcpy call; apply the equivalent of commit fe10872e53efba9cc36c66ac4ab3b41a839d5172 where backports are available.

How to confirm the fix worked

Confirm the patch is present by inspecting the __timerlat_dump_stack function to ensure size is set prior to memcpy, then test timerlat with stack saving to verify no panic occurs.

Typical attack path

1. Obtain local access on a vulnerable Linux kernel
2. Enable timerlat tracing with stack saving enabled
3. Trigger conditions that leave entry->size uninitialized at zero
4. Cause the memcpy to be evaluated by FORTIFY_SOURCE checks
5. Induce kernel panic for denial of service or to facilitate further exploitation

How to detect it

Search kernel logs for fortify_panic or buffer overflow warnings mentioning timerlat_dump_stack or __timerlat_dump_stack; inspect dmesg and audit logs around tracing-related processes.

• memcpy: detected buffer overflow: 88 byte write of buffer size 0
• __fortify_panic
• __timerlat_dump_stack.cold
• timerlat_dump_stack.part.0
• timerlatu/

What your security team should do

• Prioritize kernel updates on all systems using timerlat tracing
• Disable stack saving in timerlat until patches are applied if tracing is non-essential
• Monitor for related kernel memory corruption activity from the listed threat actors
• Review EPSS trend and schedule testing within standard change windows