#VU107675 Use-after-free in Linux kernel - CVE-2025-22035

Vulnerability identifier: #VU107675

Vulnerability risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-22035

CWE-ID: CWE-416

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the wakeup_trace_open() function in kernel/trace/trace_sched_wakeup.c, within the irqsoff_trace_open() function in kernel/trace/trace_irqsoff.c, within the graph_trace_close() function in kernel/trace/trace_functions_graph.c. A local user can escalate privileges on the system.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: 6.13, 6.13.1, 6.13.2, 6.13.3, 6.13.4, 6.13.5, 6.13.6, 6.13.7, 6.13.8, 6.13.9, 6.13.10

---

External links
https://git.kernel.org/stable/c/099ef3385800828b74933a96c117574637c3fb3a
https://git.kernel.org/stable/c/42561fe62c3628ea3bc9623f64f047605e98857f
https://git.kernel.org/stable/c/70be951bc01e4a0e10d443f3510bb17426f257fb
https://git.kernel.org/stable/c/7f81f27b1093e4895e87b74143c59c055c3b1906
https://git.kernel.org/stable/c/81a85b12132c8ffe98f5ddbdc185481790aeaa1b
https://git.kernel.org/stable/c/a2cce54c1748216535dda02e185d07a084be837e
https://git.kernel.org/stable/c/c85efe6e13743cac6ba4ccf144cb91f44c86231a
https://git.kernel.org/stable/c/de7b309139f862a44379ecd96e93c9133c69f813
https://git.kernel.org/stable/c/f14752d66056d0c7bffe5092130409417d3baa70
https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.13.11

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.