CVE-2025-37938 tracing: Verify event formats that have "%*p.."
A missing verification in Linux kernel trace event formats allows reading freed memory, potentially causing a kernel crash via null dereference.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-37938?
CVE-2025-37938 is a high-severity vulnerability in Debian Debian Linux, published on 20 May 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
tracing: Verify event formats that have "%*p.."
The trace event verifier checks the formats of trace events to make sure that they do not point at memory that is not in the trace event itself or in data that will never be freed. If an event references data that was allocated when the event triggered and that same data is freed before the event is read, then the kernel can crash by reading freed memory.
The verifier runs at boot up (or module load) and scans the print formats of the events and checks their arguments to make sure that dereferenced pointers are safe. If the format uses "%*p.." the verifier will ignore it, and that could be dangerous. Cover this case as well.
Also add to the sample code a use case of "%*pbl".
Weakness: CWE-476
Which versions are affected by CVE-2025-37938?
It affects 2 products.
Products include Debian Debian Linux, Linux kernel.
How do I fix CVE-2025-37938?
Apply the vendor's patch.
Is CVE-2025-37938 being exploited?
There is no known exploitation of CVE-2025-37938 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as AZL-72829, BELL-CVE-2025-37938, DEBIAN-CVE-2025-37938, GHSA-r878-fwjf-3cg7, ROOT-OS-UBUNTU-2204-CVE-2025-37938, ROOT-OS-UBUNTU-2404-CVE-2025-37938 and 1 more.