CVE-2025-39829

What it actually does

Missing unregister_pm_notifier call in the error path of start_graph_tracing leaves the ftrace_suspend_notifier_call registered, causing notifier_chain_register to emit a warning on the next write to function_profile_enabled.

Why it matters to the business

Kernel warning messages appear during repeated use of function profiling, increasing operational noise and complicating troubleshooting on affected Linux systems without introducing direct data loss or service outage.

How an attack unfolds

An unprivileged user writes to the function_profile_enabled sysfs interface; when start_graph_tracing fails, the notifier stays registered; a subsequent write triggers the duplicate-registration warning in the kernel notifier core.

How to fix it

Upgrade affected packages to the listed fixed versions (mah-jong 1.5.6-2 on Debian releases; Linux kernel commit 2a2deb9f8df70480050351ac27041f19bb9e718b or later) and reboot if the running kernel is replaced.

How to confirm the fix worked

Confirm the unregister_pm_notifier call exists in the error path of register_ftrace_graph, then exercise writes to function_profile_enabled and verify absence of the notifier warning.

Typical attack path

1. Locate and open /sys/kernel/debug/tracing/function_profile_enabled
2. Write a value that causes start_graph_tracing to fail
3. Repeat the write to trigger the notifier registration warning

How to detect it

Search kernel logs and dmesg for the exact warning text mentioning ftrace_suspend_notifier_call and notifier_chain_register; correlate timestamps with writes to function_profile_enabled.

• notifier callback ftrace_suspend_notifier_call already registered
• WARNING: CPU: .* PID: .* at kernel/notifier.c:23 notifier_chain_register+0x44/0xb0

What your security team should do

• Apply the kernel or package update within normal change windows given low EPSS and no KEV listing
• Add the notifier warning string to log monitoring rules for early visibility
• Review any custom tracing scripts that toggle function_profile_enabled