Critical Vulnerability in Linux Kernel: Uprobes/X86 Syscall Trampoline Check
Summary
DEBIAN-CVE-2025-22046: In the Linux kernel, the following vulnerability has been resolved: uprobes/x86: Harden uretprobe syscall trampoline check Jann reported a possible issue when trampoline_check_ip returns address near the bottom of the ad... Affects linux versions < 6.12.25-1. Fixed in 6.12.25-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of a Linux operating system, responsible for managing hardware resources and providing essential services to software applications. It is widely used in various environments, from servers to embedded systems. The kernel's robustness is crucial for system stability and security. However, vulnerabilities can arise, affecting its integrity and the overall security of systems relying on it.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified related to the uprobes/x86 syscall trampoline check. This issue was reported by Jann and concerns the trampoline_check_ip function, which may return an address near the bottom of the address space that is permitted to call into the syscall if uretprobes are not properly set up. Although mmap minimum address restrictions typically prevent creating mappings in this area, it is essential to ensure that uretprobe syscall checks are in place to mitigate potential exploitation risks.
How To Fix
Minimum fixed version
6.12.25-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workarounds have been documented for this vulnerability. It is advisable to apply the patch as soon as it is available to mitigate risks.
Conclusion
The identified vulnerability in the Linux kernel regarding the uprobes/x86 syscall trampoline check poses significant security risks. It is imperative to update to the patched version to safeguard your system. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time, ensuring your software remains secure.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves a potential issue with the syscall trampoline check in the Linux kernel, which could allow unauthorized access if uretprobes are not set up correctly.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By utilizing the Vulert playground, you can check if your application is affected without needing to sign up.
Failure to address this vulnerability may expose your system to exploitation, potentially allowing unauthorized access or control over system resources.
Yes, the vulnerability affects Linux kernel versions prior to 6.12.25-1. It is crucial to update to this version or later to ensure security.
Regularly checking for vulnerabilities is essential. It is recommended to monitor your software continuously and apply updates as soon as they are available.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
