CVE-2025-37938: tracing: Verify event formats that have "%*p.."

Vulnerability summary

CVE-2025-37938 is a high (CVSS 7.1) NULL Pointer Dereference vulnerability in debian debian_linux. EPSS estimates a 0.21% chance of exploitation in the next 30 days, higher than 10.1% of scored vulnerabilities.

Timeline

1. 20-05-2025
   PublishedVulnerability first disclosed.
2. 15-10-2026
   Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: tracing: Verify event formats that have "%*p.." The trace event verifier checks the formats of trace events to make sure that they do not point at memory that is not in the trace event itself or in data that will never be freed. If an event references data that was allocated when the event triggered and that same data is freed before the event is read, then the kernel can crash by reading freed memory. The verifier runs at boot up (or module load) and scans the print formats of the events and checks their arguments to make sure that dereferenced pointers are safe. If the format uses "%*p.." the verifier will ignore it, and that could be dangerous. Cover this case as well. Also add to the sample code a use case of "%*pbl".

• CWE-476NULL Pointer DereferenceThe product dereferences a pointer that it expects to be valid but is NULL.