CVE-2025-39914: tracing: Silence warning when chunk allocation fails in trace_pid_write

Published Oct 1, 2025
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

tracing: Silence warning when chunk allocation fails in tracepidwrite

Syzkaller trigger a fault injection warning:

WARNING: CPU: 1 PID: 12326 at tracepointaddfunc+0xbfc/0xeb0 Modules linked in: CPU: 1 UID: 0 PID: 12326 Comm: syz.6.10325 Tainted: G U 6.14.0-rc5-syzkaller #0 Tainted: [U]=USER Hardware name: Google Compute Engine/Google Compute Engine RIP: 0010:tracepointaddfunc+0xbfc/0xeb0 kernel/tracepoint.c:294 Code: 09 fe ff 90 0f 0b 90 0f b6 74 24 43 31 ff 41 bc ea ff ff ff RSP: 0018:ffffc9000414fb48 EFLAGS: 00010283 RAX: 00000000000012a1 RBX: ffffffff8e240ae0 RCX: ffffc90014b78000 RDX: 0000000000080000 RSI: ffffffff81bbd78b RDI: 0000000000000001 RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000001 R12: ffffffffffffffef R13: 0000000000000000 R14: dffffc0000000000 R15: ffffffff81c264f0 FS: 00007f27217f66c0(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b2e80dff8 CR3: 00000000268f8000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> tracepointproberegisterprio+0xc0/0x110 kernel/tracepoint.c:464 registertraceprioschedswitch include/trace/events/sched.h:222 [inline] registerpidevents kernel/trace/traceevents.c:2354 [inline] eventpidwrite.isra.0+0x439/0x7a0 kernel/trace/traceevents.c:2425 vfswrite+0x24c/0x1150 fs/readwrite.c:677 ksyswrite+0x12b/0x250 fs/readwrite.c:731 dosyscallx64 arch/x86/entry/common.c:52 [inline] dosyscall64+0xcd/0x250 arch/x86/entry/common.c:83 entrySYSCALL64afterhwframe+0x77/0x7f

We can reproduce the warning by following the steps below: 1. echo 8 >> seteventnotracepid. Let tr->filteredpids owns one pid and register schedswitch tracepoint. 2. echo ' ' >> seteventpid, and perform fault injection during chunk allocation of tracepidlistalloc. Let pidlist with no pid and assign to tr->filteredpids. 3. echo ' ' >> seteventpid. Let pidlist is NULL and assign to tr->filteredpids. 4. echo 9 >> seteventpid, will trigger the double register schedswitch tracepoint warning.

The reason is that syzkaller injects a fault into the chunk allocation in tracepidlistalloc, causing a failure in tracepidlistset, which may trigger double register of the same tracepoint. This only occurs when the system is about to crash, but to suppress this warning, let's add failure handling logic to tracepidlistset.

Affected Software

13 affected componentsFixes available
Linux Kernel
Microsoft azl3 kernel 6.6.96.2-2
Microsoft azl3 kernel 6.6.104.2-4
Linux Linux kernel>=5.16<6.1.153
Linux Linux kernel>=6.2<6.6.107
Linux Linux kernel>=6.7<6.12.48
Linux Linux kernel>=6.13<6.16.8
Linux Linux kernel=6.17-rc1
Linux Linux kernel=6.17-rc2
Linux Linux kernel=6.17-rc3
Linux Linux kernel=6.17-rc4
Linux Linux kernel=6.17-rc5
Debian Debian Linux=11.0

Event History

Oct 1, 2025
CVE Published
via MITRE·07:44 AM
Data Sourced
via MITRE·07:44 AM
Description
Data Sourced
via NVD·08:15 AM
RemedyDescriptionSeverityWeaknessAffected Software
Oct 2, 2025
Data Sourced
via Microsoft·01:07 AM
DescriptionSeverityWeakness
Data Sourced
via Microsoft·01:07 AM
Affected Software
Updated
via Microsoft·01:07 AM
DescriptionSeverity
Updated
via Microsoft·01:07 AM
Affected Software

Frequently Asked Questions

1

What is the severity of CVE-2025-39914?

CVE-2025-39914 is classified as a moderate-severity vulnerability in the Linux kernel.

2

How do I fix CVE-2025-39914?

To fix CVE-2025-39914, update your Linux kernel to the latest version where the vulnerability has been addressed.

3

What does CVE-2025-39914 affect?

CVE-2025-39914 affects the Linux kernel, specifically related to tracing and chunk allocation failures.

4

Is CVE-2025-39914 exploitable?

CVE-2025-39914 can potentially cause faults, but it requires specific conditions to be exploited.

5

When was CVE-2025-39914 disclosed?

CVE-2025-39914 was disclosed as part of ongoing kernel updates for improving reliability.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203