Memory Access Vulnerability in Linux Kernel Affects Multiple Versions

CVE-2025-38636

What is CVE-2025-38636?

A memory access vulnerability in the Linux kernel arises from a misconfiguration in the definition of tracepoints using DA monitors. When KASAN is enabled, these tracepoints trigger a warning due to out-of-bounds memory access, specifically attempting to read 32 bytes from incorrect memory offsets. While the issue does not pose a direct threat as the string output halts at the null terminator, it reflects underlying flaws in how string literals are handled within the automata definitions. To remedy this, developers are advised to utilize the proper string facilities in tracepoint definitions to prevent potential vulnerabilities.

References