Kernel Panic Vulnerability in Linux Package: Buffer Overflow in timerlat_dump_stack()
Summary
DEBIAN-CVE-2025-38493: In the Linux kernel, the following vulnerability has been resolved: tracing/osnoise: Fix crash in timerlat_dump_stack() We have observed kernel panics when using timerlat with stack saving, with the following dmesg outpu... Affects linux versions < 6.12.41-1. Fixed in 6.12.41-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of the Debian operating system, providing essential functionalities for managing hardware and system resources. It is widely used across various distributions and is critical for system stability and performance. This vulnerability specifically affects the tracing functionality within the kernel, which is responsible for monitoring and debugging system performance.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the tracing subsystem, specifically in the timerlat_dump_stack() function. This issue arises from a buffer overflow caused by improper handling of the size field in the stack_entry structure. When the size field is not correctly populated before a memcpy operation, it can lead to kernel panics, resulting in system crashes. The vulnerability was introduced in commit e7186af7fb26, and it can cause significant disruptions in systems relying on the timerlat tool for performance measurement.
How To Fix
Minimum fixed version
6.12.41-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the timerlat tool until the package is updated to the patched version. This will prevent the kernel panic from occurring while the vulnerability remains unaddressed.
Conclusion
The identified vulnerability in the Linux kernel poses a significant risk of kernel panics due to a buffer overflow in the timerlat_dump_stack() function. Users are strongly advised to update their packages to the latest patched versions to ensure system stability and security. Temporary workarounds are available, but a permanent fix is essential for long-term protection.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a buffer overflow in the timerlat_dump_stack() function of the Linux kernel, which can lead to kernel panics.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
Failure to address this vulnerability may result in system crashes and instability, particularly when using the timerlat tool.
Yes, the vulnerability can be permanently fixed by updating to the specified patched versions of the Linux package.
If an immediate update is not possible, refrain from using the timerlat tool as a temporary measure to avoid triggering the kernel panic.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
