CVE-2025-39887

Name of the Vulnerable Software and Affected Versions Linux kernel versions 6.17.0-rc4-00201-gd69eb204c255 and earlier

Description A flaw exists in the Linux kernel's tracing/osnoise module, specifically within the bitmap parselist() function. A null pointer dereference can occur when the count parameter is set to 0 in the osnoise cpus write() function, leading to a kernel crash. The issue arises because kmalloc() returns a null pointer in this scenario, which is then incorrectly processed by cpulist parse(). The vulnerability can be triggered by writing "0-2" to the /sys/kernel/debug/tracing/osnoise/cpus file.

Recommendations Update the Linux kernel to a version beyond 6.17.0-rc4-00201-gd69eb204c255.