{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2025-21899",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2025-21899",
    "idYear": 2025,
    "status": "PUBLISHED",
    "publishedAt": "2025-04-01T15:26:50.791Z",
    "updatedAt": "2026-10-15T21:51:55.265Z",
    "importedAt": "2026-10-24T01:57:29.455Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "tracing: Fix bad hist from corrupting named_triggers list",
      "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Fix bad hist from corrupting named_triggers list\n\nThe following commands causes a crash:\n\n ~# cd /sys/kernel/tracing/events/rcu/rcu_callback\n ~# echo 'hist:name=bad:keys=common_pid:onmax(bogus).save(common_pid)' > trigger\n bash: echo: write error: Invalid argument\n ~# echo 'hist:name=bad:keys=common_pid' > trigger\n\nBecause the following occurs:\n\nevent_trigger_write() {\n  trigger_process_regex() {\n    event_hist_trigger_parse() {\n\n      data = event_trigger_alloc(..);\n\n      event_trigger_register(.., data) {\n        cmd_ops->reg(.., data, ..) [hist_register_trigger()] {\n          data->ops->init() [event_hist_trigger_init()] {\n            save_named_trigger(name, data) {\n              list_add(&data->named_list, &named_triggers);\n            }\n          }\n        }\n      }\n\n      ret = create_actions(); (return -EINVAL)\n      if (ret)\n        goto out_unreg;\n[..]\n      ret = hist_trigger_enable(data, ...) {\n        list_add_tail_rcu(&data->list, &file->triggers); <<<---- SKIPPED!!! (this is important!)\n[..]\n out_unreg:\n      event_hist_unregister(.., data) {\n        cmd_ops->unreg(.., data, ..) [hist_unregister_trigger()] {\n          list_for_each_entry(iter, &file->triggers, list) {\n            if (!hist_trigger_match(data, iter, named_data, false))   <- never matches\n                continue;\n            [..]\n            test = iter;\n          }\n          if (test && test->ops->free) <<<-- test is NULL\n\n            test->ops->free(test) [event_hist_trigger_free()] {\n              [..]\n              if (data->name)\n                del_named_trigger(data) {\n                  list_del(&data->named_list);  <<<<-- NEVER gets removed!\n                }\n              }\n           }\n         }\n\n         [..]\n         kfree(data); <<<-- frees item but it is still on list\n\nThe next time a hist with name is registered, it causes an u-a-f bug and\nthe kernel can crash.\n\nMove the code around such that if event_trigger_register() succeeds, the\nnext thing called is hist_trigger_enable() which adds it to the list.\n\nA bunch of actions is called if get_named_trigger_data() returns false.\nBut that doesn't need to be called after event_trigger_register(), so it\ncan be moved up, allowing event_trigger_register() to be called just\nbefore hist_trigger_enable() keeping them together and allowing the\nfile->triggers to be properly populated.",
      "affected": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "067fe038e70f6e64960d26a79c4df5f1413d0f13",
              "status": "affected",
              "versionType": "git",
              "lessThan": "5ae1b18f05ee2b849dc03b6c15d7da0c1c6efa77"
            },
            {
              "version": "067fe038e70f6e64960d26a79c4df5f1413d0f13",
              "status": "affected",
              "versionType": "git",
              "lessThan": "43b254d46c740bf9dbe65709afa021dd726dfa99"
            },
            {
              "version": "067fe038e70f6e64960d26a79c4df5f1413d0f13",
              "status": "affected",
              "versionType": "git",
              "lessThan": "435d2964af815aae456db554c62963b4515f19d0"
            },
            {
              "version": "067fe038e70f6e64960d26a79c4df5f1413d0f13",
              "status": "affected",
              "versionType": "git",
              "lessThan": "f1ae50cfb818ce1ac7a674406dfadb7653e2552d"
            },
            {
              "version": "067fe038e70f6e64960d26a79c4df5f1413d0f13",
              "status": "affected",
              "versionType": "git",
              "lessThan": "6f86bdeab633a56d5c6dccf1a2c5989b6a5e323e"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "versions": [
            {
              "version": "4.17",
              "status": "affected"
            },
            {
              "version": "0",
              "status": "unaffected",
              "versionType": "semver",
              "lessThan": "4.17"
            },
            {
              "version": "6.1.130",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "version": "6.6.81",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "version": "6.12.18",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "version": "6.13.6",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.13.*"
            },
            {
              "version": "6.14",
              "status": "unaffected",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ]
        }
      ]
    }
  }
}