CVE-2025-21834: seccomp: passthrough uretprobe systemcall without filtering
In the Linux kernel, the following vulnerability has been resolved:
seccomp: passthrough uretprobe systemcall without filtering
When attaching uretprobes to processes running inside docker, the attached process is segfaulted when encountering the retprobe.
The reason is that now that uretprobe is a system call the default seccomp filters in docker block it as they only allow a specific set of known syscalls. This is true for other userspace applications which use seccomp to control their syscall surface.
Since uretprobe is a "kernel implementation detail" system call which is not used by userspace application code directly, it is impractical and there's very little point in forcing all userspace applications to explicitly allow it in order to avoid crashing tracked processes.
Pass this systemcall through seccomp without depending on configuration.
Note: uretprobe is currently only x8664 and isn't expected to ever be supported in i386.
[kees: minimized changes for easier backporting, tweaked commit log]
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-21834?
CVE-2025-21834 has been classified as a high severity vulnerability due to its potential to cause segmentation faults in affected applications.
How do I fix CVE-2025-21834?
To fix CVE-2025-21834, update to the latest version of the Linux kernel where this vulnerability has been resolved.
Which versions of the Linux kernel are affected by CVE-2025-21834?
CVE-2025-21834 affects versions of the Linux kernel prior to the patches applied in the recent updates.
What is a uretprobe in relation to CVE-2025-21834?
A uretprobe is a dynamic tracing mechanism in the Linux kernel that allows developers to monitor the function return points of user-space applications, which is exploited in CVE-2025-21834.
How does CVE-2025-21834 impact Docker containers?
CVE-2025-21834 causes processes running inside Docker containers to experience segmentation faults when uretprobes are attached, leading to application instability.