CVE-2025-21899

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> tracing: Fix bad hist from corrupting named_triggers list<br /> <br /> The following commands causes a crash:<br /> <br /> ~# cd /sys/kernel/tracing/events/rcu/rcu_callback<br /> ~# echo &amp;#39;hist:name=bad:keys=common_pid:onmax(bogus).save(common_pid)&amp;#39; &gt; trigger<br /> bash: echo: write error: Invalid argument<br /> ~# echo &amp;#39;hist:name=bad:keys=common_pid&amp;#39; &gt; trigger<br /> <br /> Because the following occurs:<br /> <br /> event_trigger_write() {<br /> trigger_process_regex() {<br /> event_hist_trigger_parse() {<br /> <br /> data = event_trigger_alloc(..);<br /> <br /> event_trigger_register(.., data) {<br /> cmd_ops-&gt;reg(.., data, ..) [hist_register_trigger()] {<br /> data-&gt;ops-&gt;init() [event_hist_trigger_init()] {<br /> save_named_trigger(name, data) {<br /> list_add(&amp;data-&gt;named_list, &amp;named_triggers);<br /> }<br /> }<br /> }<br /> }<br /> <br /> ret = create_actions(); (return -EINVAL)<br /> if (ret)<br /> goto out_unreg;<br /> [..]<br /> ret = hist_trigger_enable(data, ...) {<br /> list_add_tail_rcu(&amp;data-&gt;list, &amp;file-&gt;triggers); free) name)<br /> del_named_trigger(data) {<br /> list_del(&amp;data-&gt;named_list);