CVE-2025-39683

What it actually does

Failure to null-terminate parser->buffer after trace_get_user fails on input exceeding FTRACE_BUFF_MAX allows slab-out-of-bounds read via strsep in ftrace_process_regex during ftrace_regex_release.

Why it matters to the business

Local users on affected Linux systems can trigger kernel memory access violations leading to crashes or potential information leaks, reducing system stability and requiring urgent patching on production workloads.

How an attack unfolds

An attacker writes an excessively long string to set_ftrace_filter; trace_get_user fails without terminating the buffer; ftrace_regex_release then invokes strsep which reads past the allocated slab, producing a KASAN report or crash.

How to fix it

Apply the upstream fix that limits access to parser->buffer when trace_get_user fails; update affected kernels accordingly. For snowflakedb/snowflake-connector-net update to commit 77bc96d51312c41f6eda64cc4e0b69072d26b7ef.

How to confirm the fix worked

Confirm the patch is present by checking that trace_get_user failure now explicitly null-terminates the buffer before any strsep call; test with oversized input and verify absence of KASAN reports.

Typical attack path

1. Write string longer than FTRACE_BUFF_MAX to set_ftrace_filter
2. Cause ftrace_regex_release to execute
3. Trigger strsep on unterminated buffer resulting in OOB read

How to detect it

Review kernel logs for KASAN slab-out-of-bounds reports mentioning strsep and ftrace_regex_release; inspect audit logs for writes to set_ftrace_filter by non-root processes.

What your security team should do

• Prioritize kernel updates on all systems exposing ftrace to untrusted local users
• Monitor EPSS trend and re-evaluate if exploit maturity increases
• Restrict ftrace interface access via permissions or seccomp where possible