{"id":"CVE-2025-39887","summary":"tracing/osnoise: Fix null-ptr-deref in bitmap_parselist()","details":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing/osnoise: Fix null-ptr-deref in bitmap_parselist()\n\nA crash was observed with the following output:\n\nBUG: kernel NULL pointer dereference, address: 0000000000000010\nOops: Oops: 0000 [#1] SMP NOPTI\nCPU: 2 UID: 0 PID: 92 Comm: osnoise_cpus Not tainted 6.17.0-rc4-00201-gd69eb204c255 #138 PREEMPT(voluntary)\nRIP: 0010:bitmap_parselist+0x53/0x3e0\nCall Trace:\n \u003cTASK\u003e\n osnoise_cpus_write+0x7a/0x190\n vfs_write+0xf8/0x410\n ? do_sys_openat2+0x88/0xd0\n ksys_write+0x60/0xd0\n do_syscall_64+0xa4/0x260\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n \u003c/TASK\u003e\n\nThis issue can be reproduced by below code:\n\nfd=open(\"/sys/kernel/debug/tracing/osnoise/cpus\", O_WRONLY);\nwrite(fd, \"0-2\", 0);\n\nWhen user pass 'count=0' to osnoise_cpus_write(), kmalloc() will return\nZERO_SIZE_PTR (16) and cpulist_parse() treat it as a normal value, which\ntrigger the null pointer dereference. Add check for the parameter 'count'.","modified":"2026-04-02T12:48:11.794490Z","published":"2025-09-23T06:00:53.648Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/39xxx/CVE-2025-39887.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/c1628c00c4351dd0727ef7f670694f68d9e663d8"},{"type":"WEB","url":"https://git.kernel.org/stable/c/e33228a2cc7ff706ca88533464e8a3b525b961ed"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/39xxx/CVE-2025-39887.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39887"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"17f89102fe23d7389085a8820550df688f79888a"},{"fixed":"e33228a2cc7ff706ca88533464e8a3b525b961ed"},{"fixed":"c1628c00c4351dd0727ef7f670694f68d9e663d8"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-39887.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}