CVE-2025-68329

Unknown Unknown - Not Provided

Kernel Warning Triggered by Improper Trace Buffer VMA Splitting

Publication date: 2025-12-22

Last updated on: 2025-12-22

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix WARN_ON in tracing_buffers_mmap_close for split VMAs When a VMA is split (e.g., by partial munmap or MAP_FIXED), the kernel calls vm_ops->close on each portion. For trace buffer mappings, this results in ring_buffer_unmap() being called multiple times while ring_buffer_map() was only called once. This causes ring_buffer_unmap() to return -ENODEV on subsequent calls because user_mapped is already 0, triggering a WARN_ON. Trace buffer mappings cannot support partial mappings because the ring buffer structure requires the complete buffer including the meta page. Fix this by adding a may_split callback that returns -EINVAL to prevent VMA splits entirely.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-22

Last Modified

2025-12-22

Generated

2026-07-06

AI Q&A

2025-12-23

EPSS Evaluated

2026-07-05

NVD

CVE-2025-68329

EUVD

EUVD-2025-204731

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability occurs in the Linux kernel's tracing subsystem. When a virtual memory area (VMA) is split, such as by partial munmap or MAP_FIXED, the kernel calls the close operation on each split portion. For trace buffer mappings, this causes the ring_buffer_unmap() function to be called multiple times even though ring_buffer_map() was called only once. Because the user_mapped count is already zero after the first unmap, subsequent calls return an error (-ENODEV) and trigger a WARN_ON, which is a kernel warning. The root cause is that trace buffer mappings require the entire buffer to be mapped and cannot support partial mappings. The fix adds a callback to prevent VMA splits entirely by returning an error (-EINVAL) when a split is attempted.

Impact Analysis

This vulnerability can cause kernel warnings (WARN_ON) and potentially instability in the tracing subsystem when VMAs are split improperly. It may lead to unexpected errors or crashes related to trace buffer mappings, affecting system reliability and debugging capabilities.

Mitigation Strategies

Apply the patch or update to a Linux kernel version that includes the fix for this vulnerability, which prevents VMA splits in trace buffer mappings by adding a may_split callback returning -EINVAL. Avoid using partial munmap or MAP_FIXED on trace buffer mappings until the fix is applied.

Hi! I’m here to help you understand CVE-2025-68329. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70