CVE-2025-39813

What it actually does

Race condition in ftrace_dump_one allows trace_printk_seq to be invoked after trace_iterator_reset sets seq.len and seq.size to zero while ring buffer data is concurrently consumed, triggering WARN_ON_ONCE when trace_find_next_entry_inc returns NULL.

Why it matters to the business

Low-probability kernel warnings or tracing instability on systems using ftrace for diagnostics; minimal operational disruption given low EPSS and absence from known exploited lists, though kernel updates remain advisable for stability.

How an attack unfolds

Local attacker triggers ftrace_dump (for example via sysrq z) while another process reads trace_pipe, exploiting the window between trace_empty and trace_find_next_entry_inc so that iter.seq is not populated before the warning check; no named threat actors or ransomware campaigns associated.

How to fix it

Upgrade to a kernel containing commit f299353e7ccbcc5c2ed8993c48fbe7609cbe729a; Debian eterm packages should be updated to 0.9.2-1 or later where applicable.

How to confirm the fix worked

Confirm kernel build includes the referenced commit; run concurrent ftrace_dump and trace_pipe operations to verify the warning no longer triggers.

Typical attack path

1. Obtain local user access on affected Linux system
2. Initiate concurrent ftrace_dump operation and trace_pipe read
3. Trigger the race window that leaves iter.seq unpopulated
4. Observe kernel warning in logs

How to detect it

Search kernel logs and dmesg for WARN_ON_ONCE messages referencing trace_printk_seq or ftrace_dump_one during concurrent trace operations.

What your security team should do

• Apply the fixed kernel version across all affected systems
• Review ftrace usage and disable unnecessary tracing interfaces if feasible
• Monitor kernel logs for trace_printk_seq warnings as a temporary detection measure