Listen to this Post
The CVE-2025-39829 vulnerability exists in the Linux kernel’s trace/fgraph subsystem. When user-space writes to the function_profile_enabled interface via sysfs, the kernel executes register_ftrace_graph to enable function graph tracing. This function registers a power management notifier called ftrace_suspend_notifier_call. If the subsequent start_graph_tracing function fails due to resource issues or errors, the exception path does not properly unregister this notifier. Consequently, the notifier remains active in the kernel’s notifier chain. On any subsequent write to function_profile_enabled, the system attempts to register the same notifier again, triggering a duplicate registration warning. The warning message “notifier callback ftrace_suspend_notifier_call already registered” is logged via the notifier_chain_register function. This indicates a missing unregister_pm_notifier call in the error handling path of register_ftrace_graph. The vulnerability primarily causes kernel warnings that can flood system logs, potentially obscuring other critical messages and affecting monitoring tools. It was identified during testing on kernel version v6.16, but the code path likely exists in earlier versions. The fix involves adding the unregister_pm_notifier call in the exception path to ensure proper cleanup, thus preventing the warning and maintaining notifier chain integrity.
Platform: Linux kernel
Version: Multiple kernel versions
Vulnerability: Missing notifier unregistration
Severity: Medium
date: 2025-09-16
Prediction: Expected patch 2025-09-16
What Undercode Say:
Analytics:
- Check kernel version: `uname -r`
– Monitor warning logs: `dmesg | grep “already registered”`
– Write trace interface: `echo 1 > /sys/kernel/debug/tracing/function_profile_enabled`
How Exploit:
Repeated writes causing warning floods, potential log overflow, denial-of-service.
Protection from this CVE
Apply kernel patch, update system.
Impact:
System warnings, log capacity issues, minor instability.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
