UBUNTU-CVE-2025-21899: High severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix bad hist from corrupting namedtriggers list The following commands causes a crash: ~# cd /sys/kernel/tracing/events/rcu/rcucallback ~# echo 'hist:name=bad:keys=commonpid:onmax(bogus).save(commonpid)' > trigger bash: echo: write error: Invalid argument ~# echo 'hist:name=bad:keys=commonpid' > trigger Because the following occurs: eventtriggerwrite() { triggerprocessregex() { eventhisttriggerparse() { data = eventtriggeralloc(..); eventtriggerregister(.., data) { cmdops->reg(.., data, ..) [histregistertrigger()] { data->ops->init() [eventhisttriggerinit()] { savenamedtrigger(name, data) { listadd(&data->namedlist, &namedtriggers); } } } } ret = createactions(); (return -EINVAL) if (ret) goto outunreg; [..] ret = histtriggerenable(data, ...) { listaddtailrcu(&data->list, &file->triggers); <<<---- SKIPPED!!! (this is important!) [..] outunreg: eventhistunregister(.., data) { cmdops->unreg(.., data, ..) [histunregistertrigger()] { listforeachentry(iter, &file->triggers, list) { if (!histtriggermatch(data, iter, nameddata, false)) <- never matches continue; [..] test = iter; } if (test && test->ops->free) <<<-- test is NULL test->ops->free(test) [eventhisttriggerfree()] { [..] if (data->name) delnamedtrigger(data) { listdel(&data->namedlist); <<<<-- NEVER gets removed! } } } } [..] kfree(data); <<<-- frees item but it is still on list The next time a hist with name is registered, it causes an u-a-f bug and the kernel can crash. Move the code around such that if eventtriggerregister() succeeds, the next thing called is histtriggerenable() which adds it to the list. A bunch of actions is called if getnamedtriggerdata() returns false. But that doesn't need to be called after eventtriggerregister(), so it can be moved up, allowing eventtriggerregister() to be called just before histtriggerenable() keeping them together and allowing the file->triggers to be properly populated.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1039.41~22.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1036.42~22.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1040.42~22.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-85.85~22.04.1 - Upgrade
Upgrade
ubuntu/linux-ibm-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1037.37~22.04.1 - Upgrade
Upgrade
ubuntu/linux-lowlatency-hwe-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-84.84.1~22.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1039.42~22.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1037.38~22.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-84.84~22.04.1 - Upgrade
Upgrade
ubuntu/linux-realtime-6.8to a version that resolves this vulnerability.Fixed in 6.8.1-1034.35~22.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 6.8.0-84.84 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 6.8.0-1039.41 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 6.8.0-1038.44 - Upgrade
Upgrade
ubuntu/linux-azure-6.11to a version that resolves this vulnerability.Fixed in 6.11.0-1015.15~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-nvidiato a version that resolves this vulnerability.Fixed in 6.8.0-1025.27 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 6.8.0-1040.42 - Upgrade
Upgrade
ubuntu/linux-gcp-6.11to a version that resolves this vulnerability.Fixed in 6.11.0-1015.15~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 6.8.0-1036.40 - Upgrade
Upgrade
ubuntu/linux-gkeopto a version that resolves this vulnerability.Fixed in 6.8.0-1023.25 - Upgrade
Upgrade
ubuntu/linux-hwe-6.11to a version that resolves this vulnerability.Fixed in 6.11.0-26.26~24.04.1 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 6.8.0-1037.37 - Upgrade
Upgrade
ubuntu/linux-lowlatencyto a version that resolves this vulnerability.Fixed in 6.8.0-84.84.1 - Upgrade
Upgrade
ubuntu/linux-lowlatency-hwe-6.11to a version that resolves this vulnerability.Fixed in 6.11.0-1014.15~24.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidiato a version that resolves this vulnerability.Fixed in 6.8.0-1039.42 - Upgrade
Upgrade
ubuntu/linux-nvidia-6.11to a version that resolves this vulnerability.Fixed in 6.11.0-1010.10 - Upgrade
Upgrade
ubuntu/linux-nvidia-lowlatencyto a version that resolves this vulnerability.Fixed in 6.8.0-1039.42.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1010.10 - Upgrade
Upgrade
ubuntu/linux-oem-6.11to a version that resolves this vulnerability.Fixed in 6.11.0-1022.22 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 6.8.0-1037.38 - Upgrade
Upgrade
ubuntu/linux-raspito a version that resolves this vulnerability.Fixed in 6.8.0-1039.43 - Upgrade
Upgrade
ubuntu/linux-xilinxto a version that resolves this vulnerability.Fixed in 6.8.0-1018.19 - Upgrade
Upgrade
ubuntu/linux-raspi-realtimeto a version that resolves this vulnerability.Fixed in 6.8.0-2030.31 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 6.8.1-1034.35 - Upgrade
Upgrade
ubuntu/linux-aws-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1039.41+fips1 - Upgrade
Upgrade
ubuntu/linux-azure-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1040.46+fips1 - Upgrade
Upgrade
ubuntu/linux-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-84.84+fips1 - Upgrade
Upgrade
ubuntu/linux-gcp-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1040.42+fips1 - Compensating control
Reorder the tracing histogram trigger registration flow so that after event_trigger_register() succeeds, hist_trigger_enable() is called next and populates file->triggers; move the get_named_trigger_data()/related action processing earlier as needed to prevent a failed registration from leaving a freed item on named_triggers.