CVE-2025-22035 – A use-after-free vulnerability in the Linux ker... (How to Fix)

Q: What is the severity of CVE-2025-22035?

CVE-2025-22035 has a CVSS score of 7.8 (HIGH). A use-after-free vulnerability in the Linux kernel's tracing subsystem allows local attackers to potentially crash the system or execute arbitrary code. This affects systems with kernel tracing enabled, primarily impacting Linux servers and workstations where users have local access.

📋 TL;DR

A use-after-free vulnerability in the Linux kernel's tracing subsystem allows local attackers to potentially crash the system or execute arbitrary code. This affects systems with kernel tracing enabled, primarily impacting Linux servers and workstations where users have local access.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific affected versions not specified in CVE, but references indicate stable kernel patches from 2023-2024

Operating Systems: Linux distributions using vulnerable kernel versions

Default Config Vulnerable: ✅ No

Notes: Requires kernel tracing functionality to be enabled and accessible. Not vulnerable if CONFIG_FUNCTION_TRACER or related tracing features are disabled.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Local privilege escalation to kernel-level code execution, leading to complete system compromise.

🟠

Likely Case

Kernel panic or system crash causing denial of service.

🟢

If Mitigated

No impact if kernel tracing is disabled or proper access controls prevent local users from modifying tracer settings.

🌐 Internet-Facing: LOW - Requires local access to trigger the vulnerability.

🏢 Internal Only: MEDIUM - Local users or compromised accounts could exploit this to disrupt systems or escalate privileges.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires local access and ability to modify tracer settings. The vulnerability was discovered during stress testing and requires specific timing conditions.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions containing commits 099ef3385800828b74933a96c117574637c3fb3a and related fixes

Vendor Advisory: https://git.kernel.org/stable/c/099ef3385800828b74933a96c117574637c3fb3a

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution vendor. 2. Reboot system to load new kernel. 3. Verify kernel version matches patched release.

🔧 Temporary Workarounds

Disable kernel tracing

linux

Disable function_graph tracer and related tracing features to prevent exploitation

echo nop > /sys/kernel/debug/tracing/current_tracer
echo 0 > /sys/kernel/debug/tracing/tracing_on

Restrict tracing access

linux

Limit access to tracing debugfs interface to privileged users only

chmod 700 /sys/kernel/debug/tracing
chown root:root /sys/kernel/debug/tracing

🧯 If You Can't Patch

Disable kernel tracing functionality via kernel boot parameters (e.g., adding 'trace_event=disable' to kernel command line)
Implement strict access controls to prevent non-privileged users from accessing /sys/kernel/debug/tracing

🔍 How to Verify

Check if Vulnerable:

Check if kernel version is before patched commits: uname -r and compare with distribution security advisories

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes the fix commits: grep -q '099ef3385800828b74933a96c117574637c3fb3a' /proc/version_signature || echo 'Check kernel source'

📡 Detection & Monitoring

Log Indicators:

Kernel oops messages
System crashes during tracer switching
Unexpected kernel panics

Network Indicators:

None - local vulnerability only

SIEM Query:

source="kernel" AND ("use-after-free" OR "UAF" OR "general protection fault" OR "kernel panic")

📊 Metadata

CVE ID: CVE-2025-22035

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-416

EPSS Score: 0.07% exploit probability (21.6th percentile)

Published: April 16, 2025

Last Updated: November 3, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-22035, you might also want to check these: