CVE-2025-38636

What it actually does

Incorrect use of __array instead of __string in DA monitor tracepoint definitions causes 32-byte out-of-bounds reads on string literals when KASAN is enabled, reported against automaton_snep data.

Why it matters to the business

Triggers kernel warnings in KASAN-enabled debug or testing environments on affected Linux systems; low operational risk but may disrupt kernel validation or logging in development pipelines.

How an attack unfolds

An attacker or test harness enables KASAN and triggers DA monitor tracepoints; the tracepoint handler then performs an oversized read past the end of a string literal into adjacent kernel data structures.

How to fix it

Update the Linux kernel to commit 0ebc70d973ce7a81826b5c4f55f743e07f5864d9 or later; for Chainguard packages upgrade openjdk-8-openj9 and related variants to 0.53.0-r1 or newer.

How to confirm the fix worked

Verify kernel build contains the __string fix in tracepoint definitions; confirm absence of KASAN warnings when exercising DA monitor tracepoints; check package versions against the listed fixed releases.

Typical attack path

1. Boot kernel with KASAN enabled
2. Activate DA monitor tracepoints
3. Observe global-out-of-bounds warning in do_trace_event_raw_event_event_da_monitor

How to detect it

Search kernel logs and KASAN reports for references to do_trace_event_raw_event_event_da_monitor and automaton_snep; review tracepoint activation events around the time of any out-of-bounds warnings.

• BUG: KASAN: global-out-of-bounds in do_trace_event_raw_event_event_da_monitor
• automaton_snep+0x4e0/0x5e0
• Read of size 32 at addr ffffffffaada8980

What your security team should do

• Prioritize kernel updates on systems running KASAN-enabled builds
• Monitor for the described KASAN warning in debug logs
• Apply the stable git commit or Chainguard package upgrades within normal patch cycles