CVE-2025-22035: tracing: Fix use-after-free in print_graph_function_flags during tracer switching

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• linux linux kernel4.14.324 and later · before 4.15
• linux linux kernel4.19.293 and later · before 4.20
• linux linux kernel5.4.255 and later · before 5.4.292
• linux linux kernel5.10.193 and later · before 5.10.236
• linux linux kernel5.15.129 and later · before 5.15.180
• linux linux kernel6.1.50 and later · before 6.1.134
• linux linux kernel6.4.13 and later · before 6.6.87
• linux linux kernel6.7 and later · before 6.12.23
• linux linux kernel6.13 and later · before 6.13.11
• linux linux kernel6.14 and later · before 6.14.2

Versions reported by the vendor

Affected version ranges reported by the assigning authority (Linux). Independent of NVD's CPE analysis and usually ahead of it.

• Linux Linux

  • d6b35c9a8d51032ed9890431da3ae39fe76c1ae3, 5d433eda76b66ab271f5924b26ddfec063eeb454, 2242640e9bd94e706acf75c60a2ab1d0e150e0fb, 6.5affected
  • 05319d707732c728eb721ac616a50e7978eb499a and later · before 42561fe62c3628ea3bc9623f64f047605e98857faffected · git
  • b8205dfed68183dc1470e83863c5ded6d7fa30a9 and later · before de7b309139f862a44379ecd96e93c9133c69f813affected · git
  • ce6e2b14bc094866d9173db6935da2d752f06d8b and later · before 81a85b12132c8ffe98f5ddbdc185481790aeaa1baffected · git
  • 2cb0c037c927db4ec928cc927488e52aa359786e and later · before a2cce54c1748216535dda02e185d07a084be837eaffected · git
  • eecb91b9f98d6427d4af5fdb8f108f52572a39e7 and later · before 099ef3385800828b74933a96c117574637c3fb3aaffected · git
  • eecb91b9f98d6427d4af5fdb8f108f52572a39e7 and later · before c85efe6e13743cac6ba4ccf144cb91f44c86231aaffected · git
  • eecb91b9f98d6427d4af5fdb8f108f52572a39e7 and later · before f14752d66056d0c7bffe5092130409417d3baa70affected · git
  • eecb91b9f98d6427d4af5fdb8f108f52572a39e7 and later · before 70be951bc01e4a0e10d443f3510bb17426f257fbaffected · git
  • eecb91b9f98d6427d4af5fdb8f108f52572a39e7 and later · before 7f81f27b1093e4895e87b74143c59c055c3b1906affected · git

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2026-31431crypto: algif_aead - Revert to operating out-of-placeKEV
  90Now
• CVE-2022-0847A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe KEV
  89Now
• CVE-2021-22555Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACEKEV
  85Now

Published before and after this one in the same product

• ← EarlierCVE-2025-22033Apr 16, 2025 · arm64: Don't call NULL in do_compat_alignment_fixup()
  22Monitor
• ← EarlierCVE-2025-22034Apr 16, 2025 · mm/gup: reject FOLL_SPLIT_PMD with hugetlb VMAs
  22Monitor
• Later →CVE-2025-22036Apr 16, 2025 · exfat: fix random stack corruption after get_block
  28Monitor

Root cause

After a memory region is freed, another reference pointing to it is still used. By then, the same region may have been allocated for different data.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1free(dev->buf);2/* ... another thread is still running ... */3process(dev->buf);

1lock(&dev->lock);2free(dev->buf);3dev->buf = NULL;4unlock(&dev->lock);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.

MITRE has no CAPEC/ATT&CK mapping for this CWE.