# CVE-2025-39974: tracing/osnoise: Fix slab-out-of-bounds in _parse_integer_limit()

> A local attacker with root privileges can trigger a slab-out-of-bounds read in the Linux kernel's osnoise tracer, potentially causing a crash or code execution.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** An administrator
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 15 Oct 2025
- **Updated:** 11 May 2026
- **Also known as:** BELL-CVE-2025-39974, DEBIAN-CVE-2025-39974, GHSA-w928-mvrh-3953, UBUNTU-CVE-2025-39974

## What is CVE-2025-39974?

CVE-2025-39974 is a memory corruption vulnerability in Linux, published on 15 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

tracing/osnoise: Fix slab-out-of-bounds in _parse_integer_limit()

When config osnoise cpus by write() syscall, the following KASAN splat may
be observed:

BUG: KASAN: slab-out-of-bounds in _parse_integer_limit+0x103/0x130
Read of size 1 at addr ffff88810121e3a1 by task test/447
CPU: 1 UID: 0 PID: 447 Comm: test Not tainted 6.17.0-rc6-dirty #288 PREEMPT(voluntary)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0x55/0x70
 print_report+0xcb/0x610
 kasan_report+0xb8/0xf0
 _parse_integer_limit+0x103/0x130
 bitmap_parselist+0x16d/0x6f0
 osnoise_cpus_write+0x116/0x2d0
 vfs_write+0x21e/0xcc0
 ksys_write+0xee/0x1c0
 do_syscall_64+0xa8/0x2a0
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
 </TASK>

This issue can be reproduced by below code:

const char *cpulist = "1";
int fd=open("/sys/kernel/debug/tracing/osnoise/cpus", O_WRONLY);
write(fd, cpulist, strlen(cpulist));

Function bitmap_parselist() was called to parse cpulist, it require that
the parameter 'buf' must be terminated with a '\0' or '\n'. Fix this issue
by adding a '\0' to 'buf' in osnoise_cpus_write().

## Which versions are affected by CVE-2025-39974?


## How do I fix CVE-2025-39974?

Apply the vendor's patch.

## Is CVE-2025-39974 being exploited?

There is no known exploitation of CVE-2025-39974 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2025-39974 and fix it if it is affected.

What it is: CVE-2025-39974 is a memory corruption vulnerability in Linux, published on 15 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2025-39974 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2025-39974/ (Markdown: https://insights.sbomify.com/CVE-2025-39974/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2025-39974
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-39974
- OSV: https://osv.dev/vulnerability/CVE-2025-39974

---
From sbomify Insights: https://insights.sbomify.com/CVE-2025-39974/
Summaries are generated and may contain mistakes; the official description above is the record.