{"id":"CVE-2025-38493","state":"PUBLISHED","title":"tracing/osnoise: Fix crash in timerlat_dump_stack()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing/osnoise: Fix crash in timerlat_dump_stack()\n\nWe have observed kernel panics when using timerlat with stack saving,\nwith the following dmesg output:\n\nmemcpy: detected buffer overflow: 88 byte write of buffer size 0\nWARNING: CPU: 2 PID: 8153 at lib/string_helpers.c:1032 __fortify_report+0x55/0xa0\nCPU: 2 UID: 0 PID: 8153 Comm: timerlatu/2 Kdump: loaded Not tainted 6.15.3-200.fc42.x86_64 #1 PREEMPT(lazy)\nCall Trace:\n <TASK>\n ? trace_buffer_lock_reserve+0x2a/0x60\n __fortify_panic+0xd/0xf\n __timerlat_dump_stack.cold+0xd/0xd\n timerlat_dump_stack.part.0+0x47/0x80\n timerlat_fd_read+0x36d/0x390\n vfs_read+0xe2/0x390\n ? syscall_exit_to_user_mode+0x1d5/0x210\n ksys_read+0x73/0xe0\n do_syscall_64+0x7b/0x160\n ? exc_page_fault+0x7e/0x1a0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\n__timerlat_dump_stack() constructs the ftrace stack entry like this:\n\nstruct stack_entry *entry;\n...\nmemcpy(&entry->caller, fstack->calls, size);\nentry->size = fstack->nr_entries;\n\nSince commit e7186af7fb26 (\"tracing: Add back FORTIFY_SOURCE logic to\nkernel_stack event structure\"), struct stack_entry marks its caller\nfield with __counted_by(size). At the time of the memcpy, entry->size\ncontains garbage from the ringbuffer, which under some circumstances is\nzero, triggering a kernel panic by buffer overflow.\n\nPopulate the size field before the memcpy so that the out-of-bounds\ncheck knows the correct size. This is analogous to\n__ftrace_trace_stack().","publishedAt":"2025-07-28T11:22:02.000Z","updatedAt":"2026-05-11T21:29:05.077Z","severity":null,"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"e7186af7fb2609584a8bfb3da3c6ae09da5a5224","status":"affected","lessThan":"823d798900481875ba6c68217af028c5ffd2976b","versionType":"git"},{"version":"e7186af7fb2609584a8bfb3da3c6ae09da5a5224","status":"affected","lessThan":"7bb9ea515cda027c9e717e27fefcf34f092e7c41","versionType":"git"},{"version":"e7186af7fb2609584a8bfb3da3c6ae09da5a5224","status":"affected","lessThan":"fbf90f5aa7ac7cddc69148a71d58f12c8709ce2b","versionType":"git"},{"version":"e7186af7fb2609584a8bfb3da3c6ae09da5a5224","status":"affected","lessThan":"85a3bce695b361d85fc528e6fbb33e4c8089c806","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["kernel/trace/trace_osnoise.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.6","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.6","versionType":"semver"},{"version":"6.6.100","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.40","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.15.8","status":"unaffected","lessThanOrEqual":"6.15.*","versionType":"semver"},{"version":"6.16","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["kernel/trace/trace_osnoise.c"]}],"references":["https://git.kernel.org/stable/c/823d798900481875ba6c68217af028c5ffd2976b","https://git.kernel.org/stable/c/7bb9ea515cda027c9e717e27fefcf34f092e7c41","https://git.kernel.org/stable/c/fbf90f5aa7ac7cddc69148a71d58f12c8709ce2b","https://git.kernel.org/stable/c/85a3bce695b361d85fc528e6fbb33e4c8089c806"],"weaknesses":[],"ingestedAt":"2026-10-29T20:09:09.358Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/38xxx/CVE-2025-38493.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-38493","state":"PUBLISHED","datePublished":"2025-07-28T11:22:02.000Z","dateUpdated":"2026-05-11T21:29:05.077Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2025-04-16T04:51:24.022Z"},"containers":{"cna":{"title":"tracing/osnoise: Fix crash in timerlat_dump_stack()","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing/osnoise: Fix crash in timerlat_dump_stack()\n\nWe have observed kernel panics when using timerlat with stack saving,\nwith the following dmesg output:\n\nmemcpy: detected buffer overflow: 88 byte write of buffer size 0\nWARNING: CPU: 2 PID: 8153 at lib/string_helpers.c:1032 __fortify_report+0x55/0xa0\nCPU: 2 UID: 0 PID: 8153 Comm: timerlatu/2 Kdump: loaded Not tainted 6.15.3-200.fc42.x86_64 #1 PREEMPT(lazy)\nCall Trace:\n <TASK>\n ? trace_buffer_lock_reserve+0x2a/0x60\n __fortify_panic+0xd/0xf\n __timerlat_dump_stack.cold+0xd/0xd\n timerlat_dump_stack.part.0+0x47/0x80\n timerlat_fd_read+0x36d/0x390\n vfs_read+0xe2/0x390\n ? syscall_exit_to_user_mode+0x1d5/0x210\n ksys_read+0x73/0xe0\n do_syscall_64+0x7b/0x160\n ? exc_page_fault+0x7e/0x1a0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\n__timerlat_dump_stack() constructs the ftrace stack entry like this:\n\nstruct stack_entry *entry;\n...\nmemcpy(&entry->caller, fstack->calls, size);\nentry->size = fstack->nr_entries;\n\nSince commit e7186af7fb26 (\"tracing: Add back FORTIFY_SOURCE logic to\nkernel_stack event structure\"), struct stack_entry marks its caller\nfield with __counted_by(size). At the time of the memcpy, entry->size\ncontains garbage from the ringbuffer, which under some circumstances is\nzero, triggering a kernel panic by buffer overflow.\n\nPopulate the size field before the memcpy so that the out-of-bounds\ncheck knows the correct size. This is analogous to\n__ftrace_trace_stack()."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"e7186af7fb2609584a8bfb3da3c6ae09da5a5224","status":"affected","lessThan":"823d798900481875ba6c68217af028c5ffd2976b","versionType":"git"},{"version":"e7186af7fb2609584a8bfb3da3c6ae09da5a5224","status":"affected","lessThan":"7bb9ea515cda027c9e717e27fefcf34f092e7c41","versionType":"git"},{"version":"e7186af7fb2609584a8bfb3da3c6ae09da5a5224","status":"affected","lessThan":"fbf90f5aa7ac7cddc69148a71d58f12c8709ce2b","versionType":"git"},{"version":"e7186af7fb2609584a8bfb3da3c6ae09da5a5224","status":"affected","lessThan":"85a3bce695b361d85fc528e6fbb33e4c8089c806","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["kernel/trace/trace_osnoise.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.6","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.6","versionType":"semver"},{"version":"6.6.100","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.40","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.15.8","status":"unaffected","lessThanOrEqual":"6.15.*","versionType":"semver"},{"version":"6.16","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["kernel/trace/trace_osnoise.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/823d798900481875ba6c68217af028c5ffd2976b"},{"url":"https://git.kernel.org/stable/c/7bb9ea515cda027c9e717e27fefcf34f092e7c41"},{"url":"https://git.kernel.org/stable/c/fbf90f5aa7ac7cddc69148a71d58f12c8709ce2b"},{"url":"https://git.kernel.org/stable/c/85a3bce695b361d85fc528e6fbb33e4c8089c806"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-05-11T21:29:05.077Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"6.6.100"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"6.12.40"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"6.15.8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"6.16"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}