{"id":"CVE-2025-68376","state":"PUBLISHED","title":"coresight: ETR: Fix ETR buffer use-after-free issue","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ncoresight: ETR: Fix ETR buffer use-after-free issue\n\nWhen ETR is enabled as CS_MODE_SYSFS, if the buffer size is changed\nand enabled again, currently sysfs_buf will point to the newly\nallocated memory(buf_new) and free the old memory(buf_old). But the\netr_buf that is being used by the ETR remains pointed to buf_old, not\nupdated to buf_new. In this case, it will result in a memory\nuse-after-free issue.\n\nFix this by checking ETR's mode before updating and releasing buf_old,\nif the mode is CS_MODE_SYSFS, then skip updating and releasing it.","publishedAt":"2025-12-24T10:33:05.503Z","updatedAt":"2026-10-21T12:38:21.502Z","severity":null,"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"bd2767ec3df2775bc336f441f9068a989ccb919d","status":"affected","lessThan":"5d5d130835b417c7bfd6c942f0149e34397d4463","versionType":"git"},{"version":"bd2767ec3df2775bc336f441f9068a989ccb919d","status":"affected","lessThan":"4e83434247ff8005a0b9a1ee997864abf8f259ec","versionType":"git"},{"version":"bd2767ec3df2775bc336f441f9068a989ccb919d","status":"affected","lessThan":"70acbc9c77686b7a521af6d7a543dcd9c324cf07","versionType":"git"},{"version":"bd2767ec3df2775bc336f441f9068a989ccb919d","status":"affected","lessThan":"cda077a19f5c8d6ec61e5b97deca203d95e3a422","versionType":"git"},{"version":"bd2767ec3df2775bc336f441f9068a989ccb919d","status":"affected","lessThan":"35501ac3c7d40a7bb9568c2f89d6b56beaf9bed3","versionType":"git"},{"version":"fdd3ceb0001da6768bede9779a0190a42e65c404","status":"affected","versionType":"git"},{"version":"6.5.8","status":"affected","lessThan":"6.6","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/hwtracing/coresight/coresight-tmc-etr.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.6","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.6","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.114","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.17.13","status":"unaffected","lessThanOrEqual":"6.17.*","versionType":"semver"},{"version":"6.18.2","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"6.19","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/hwtracing/coresight/coresight-tmc-etr.c"]}],"references":["https://git.kernel.org/stable/c/5d5d130835b417c7bfd6c942f0149e34397d4463","https://git.kernel.org/stable/c/4e83434247ff8005a0b9a1ee997864abf8f259ec","https://git.kernel.org/stable/c/70acbc9c77686b7a521af6d7a543dcd9c324cf07","https://git.kernel.org/stable/c/cda077a19f5c8d6ec61e5b97deca203d95e3a422","https://git.kernel.org/stable/c/35501ac3c7d40a7bb9568c2f89d6b56beaf9bed3"],"weaknesses":[],"ingestedAt":"2026-10-29T20:09:56.034Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/68xxx/CVE-2025-68376.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-68376","state":"PUBLISHED","datePublished":"2025-12-24T10:33:05.503Z","dateUpdated":"2026-10-21T12:38:21.502Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2025-12-16T14:48:05.310Z"},"containers":{"cna":{"title":"coresight: ETR: Fix ETR buffer use-after-free issue","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncoresight: ETR: Fix ETR buffer use-after-free issue\n\nWhen ETR is enabled as CS_MODE_SYSFS, if the buffer size is changed\nand enabled again, currently sysfs_buf will point to the newly\nallocated memory(buf_new) and free the old memory(buf_old). But the\netr_buf that is being used by the ETR remains pointed to buf_old, not\nupdated to buf_new. In this case, it will result in a memory\nuse-after-free issue.\n\nFix this by checking ETR's mode before updating and releasing buf_old,\nif the mode is CS_MODE_SYSFS, then skip updating and releasing it."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"bd2767ec3df2775bc336f441f9068a989ccb919d","status":"affected","lessThan":"5d5d130835b417c7bfd6c942f0149e34397d4463","versionType":"git"},{"version":"bd2767ec3df2775bc336f441f9068a989ccb919d","status":"affected","lessThan":"4e83434247ff8005a0b9a1ee997864abf8f259ec","versionType":"git"},{"version":"bd2767ec3df2775bc336f441f9068a989ccb919d","status":"affected","lessThan":"70acbc9c77686b7a521af6d7a543dcd9c324cf07","versionType":"git"},{"version":"bd2767ec3df2775bc336f441f9068a989ccb919d","status":"affected","lessThan":"cda077a19f5c8d6ec61e5b97deca203d95e3a422","versionType":"git"},{"version":"bd2767ec3df2775bc336f441f9068a989ccb919d","status":"affected","lessThan":"35501ac3c7d40a7bb9568c2f89d6b56beaf9bed3","versionType":"git"},{"version":"fdd3ceb0001da6768bede9779a0190a42e65c404","status":"affected","versionType":"git"},{"version":"6.5.8","status":"affected","lessThan":"6.6","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/hwtracing/coresight/coresight-tmc-etr.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.6","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.6","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.114","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.17.13","status":"unaffected","lessThanOrEqual":"6.17.*","versionType":"semver"},{"version":"6.18.2","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"6.19","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/hwtracing/coresight/coresight-tmc-etr.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/5d5d130835b417c7bfd6c942f0149e34397d4463"},{"url":"https://git.kernel.org/stable/c/4e83434247ff8005a0b9a1ee997864abf8f259ec"},{"url":"https://git.kernel.org/stable/c/70acbc9c77686b7a521af6d7a543dcd9c324cf07"},{"url":"https://git.kernel.org/stable/c/cda077a19f5c8d6ec61e5b97deca203d95e3a422"},{"url":"https://git.kernel.org/stable/c/35501ac3c7d40a7bb9568c2f89d6b56beaf9bed3"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-21T12:38:21.502Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"6.6.160"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"6.12.114"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"6.17.13"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"6.18.2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"6.19"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.5.8"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}