CVE-2025-68329
Kernel Warning Triggered by Improper Trace Buffer VMA Splitting
Publication date: 2025-12-22
Last updated on: 2025-12-22
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs in the Linux kernel's tracing subsystem. When a virtual memory area (VMA) is split, such as by partial munmap or MAP_FIXED, the kernel calls the close operation on each split portion. For trace buffer mappings, this causes the ring_buffer_unmap() function to be called multiple times even though ring_buffer_map() was called only once. Because the user_mapped count is already zero after the first unmap, subsequent calls return an error (-ENODEV) and trigger a WARN_ON, which is a kernel warning. The root cause is that trace buffer mappings require the entire buffer to be mapped and cannot support partial mappings. The fix adds a callback to prevent VMA splits entirely by returning an error (-EINVAL) when a split is attempted.
How can this vulnerability impact me? :
This vulnerability can cause kernel warnings (WARN_ON) and potentially instability in the tracing subsystem when VMAs are split improperly. It may lead to unexpected errors or crashes related to trace buffer mappings, affecting system reliability and debugging capabilities.
What immediate steps should I take to mitigate this vulnerability?
Apply the patch or update to a Linux kernel version that includes the fix for this vulnerability, which prevents VMA splits in trace buffer mappings by adding a may_split callback returning -EINVAL. Avoid using partial munmap or MAP_FIXED on trace buffer mappings until the fix is applied.