{"id":"DEBIAN-CVE-2025-21899","details":"In the Linux kernel, the following vulnerability has been resolved:  tracing: Fix bad hist from corrupting named_triggers list  The following commands causes a crash:   ~# cd /sys/kernel/tracing/events/rcu/rcu_callback  ~# echo 'hist:name=bad:keys=common_pid:onmax(bogus).save(common_pid)' \u003e trigger  bash: echo: write error: Invalid argument  ~# echo 'hist:name=bad:keys=common_pid' \u003e trigger  Because the following occurs:  event_trigger_write() {   trigger_process_regex() {     event_hist_trigger_parse() {        data = event_trigger_alloc(..);        event_trigger_register(.., data) {         cmd_ops-\u003ereg(.., data, ..) [hist_register_trigger()] {           data-\u003eops-\u003einit() [event_hist_trigger_init()] {             save_named_trigger(name, data) {               list_add(&data-\u003enamed_list, &named_triggers);             }           }         }       }        ret = create_actions(); (return -EINVAL)       if (ret)         goto out_unreg; [..]       ret = hist_trigger_enable(data, ...) {         list_add_tail_rcu(&data-\u003elist, &file-\u003etriggers); \u003c\u003c\u003c---- SKIPPED!!! (this is important!) [..]  out_unreg:       event_hist_unregister(.., data) {         cmd_ops-\u003eunreg(.., data, ..) [hist_unregister_trigger()] {           list_for_each_entry(iter, &file-\u003etriggers, list) {             if (!hist_trigger_match(data, iter, named_data, false))   \u003c- never matches                 continue;             [..]             test = iter;           }           if (test && test-\u003eops-\u003efree) \u003c\u003c\u003c-- test is NULL              test-\u003eops-\u003efree(test) [event_hist_trigger_free()] {               [..]               if (data-\u003ename)                 del_named_trigger(data) {                   list_del(&data-\u003enamed_list);  \u003c\u003c\u003c\u003c-- NEVER gets removed!                 }               }            }          }           [..]          kfree(data); \u003c\u003c\u003c-- frees item but it is still on list  The next time a hist with name is registered, it causes an u-a-f bug and the kernel can crash.  Move the code around such that if event_trigger_register() succeeds, the next thing called is hist_trigger_enable() which adds it to the list.  A bunch of actions is called if get_named_trigger_data() returns false. But that doesn't need to be called after event_trigger_register(), so it can be moved up, allowing event_trigger_register() to be called just before hist_trigger_enable() keeping them together and allowing the file-\u003etriggers to be properly populated.","modified":"2026-09-01T16:06:10.295312260Z","published":"2025-04-01T16:15:20.327Z","upstream":["CVE-2025-21899"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2025-21899"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.133-1"}]}],"versions":["6.1.106-1","6.1.106-2","6.1.106-3","6.1.112-1","6.1.115-1","6.1.119-1","6.1.123-1","6.1.124-1","6.1.128-1","6.1.129-1","6.1.27-1","6.1.37-1","6.1.38-1","6.1.38-2","6.1.38-2~bpo11+1","6.1.38-3","6.1.38-4","6.1.38-4~bpo11+1","6.1.52-1","6.1.55-1","6.1.55-1~bpo11+1","6.1.64-1","6.1.66-1","6.1.67-1","6.1.69-1","6.1.69-1~bpo11+1","6.1.76-1","6.1.76-1~bpo11+1","6.1.82-1","6.1.85-1","6.1.90-1","6.1.90-1~bpo11+1","6.1.94-1","6.1.94-1~bpo11+1","6.1.98-1","6.1.99-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-21899.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.19-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-21899.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.19-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-21899.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}