CVE-2025-22046

MEDIUM

Linux Kernel 6.11-6.12.22, 6.13.0-6.13.10, 6.14.0-6.14.1 - RCE via Uretprobe Syscall Trampoline Check Bypass

Title source: llm
STIX 2.1

Description

In the Linux kernel, the following vulnerability has been resolved: uprobes/x86: Harden uretprobe syscall trampoline check Jann reported a possible issue when trampoline_check_ip returns address near the bottom of the address space that is allowed to call into the syscall if uretprobes are not set up: https://lore.kernel.org/bpf/202502081235.5A6F352985@keescook/T/#m9d416df341b8fbc11737dacbcd29f0054413cbbf Though the mmap minimum address restrictions will typically prevent creating mappings there, let's make sure uretprobe syscall checks for that.

Scores

CVSS v3 5.5
EPSS 0.0019
EPSS Percentile 8.7%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Details

Status published
Products (14)
linux/Kernel 6.11.0 - 6.12.23linux
linux/Kernel 6.13.0 - 6.13.11linux
linux/Kernel 6.14.0 - 6.14.2linux
Linux/Linux < 6.11
Linux/Linux 6.11
Linux/Linux 6.12.23 - 6.12.*
Linux/Linux 6.13.11 - 6.13.*
Linux/Linux 6.14.2 - 6.14.*
Linux/Linux 6.15
Linux/Linux ff474a78cef5cb5f32be52fe25b78441327a2e7c - b0065d712049c87e1994c6eac00c6a637e39b325
... and 4 more
Published Apr 16, 2025
Tracked Since Feb 18, 2026