{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-68376","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2025-12-16T14:48:05.310Z","datePublished":"2025-12-24T10:33:05.503Z","dateUpdated":"2026-05-11T21:52:00.782Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-05-11T21:52:00.782Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncoresight: ETR: Fix ETR buffer use-after-free issue\n\nWhen ETR is enabled as CS_MODE_SYSFS, if the buffer size is changed\nand enabled again, currently sysfs_buf will point to the newly\nallocated memory(buf_new) and free the old memory(buf_old). But the\netr_buf that is being used by the ETR remains pointed to buf_old, not\nupdated to buf_new. In this case, it will result in a memory\nuse-after-free issue.\n\nFix this by checking ETR's mode before updating and releasing buf_old,\nif the mode is CS_MODE_SYSFS, then skip updating and releasing it."}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/hwtracing/coresight/coresight-tmc-etr.c"],"versions":[{"version":"bd2767ec3df2775bc336f441f9068a989ccb919d","lessThan":"70acbc9c77686b7a521af6d7a543dcd9c324cf07","status":"affected","versionType":"git"},{"version":"bd2767ec3df2775bc336f441f9068a989ccb919d","lessThan":"cda077a19f5c8d6ec61e5b97deca203d95e3a422","status":"affected","versionType":"git"},{"version":"bd2767ec3df2775bc336f441f9068a989ccb919d","lessThan":"35501ac3c7d40a7bb9568c2f89d6b56beaf9bed3","status":"affected","versionType":"git"},{"version":"fdd3ceb0001da6768bede9779a0190a42e65c404","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/hwtracing/coresight/coresight-tmc-etr.c"],"versions":[{"version":"6.6","status":"affected"},{"version":"0","lessThan":"6.6","status":"unaffected","versionType":"semver"},{"version":"6.17.13","lessThanOrEqual":"6.17.*","status":"unaffected","versionType":"semver"},{"version":"6.18.2","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"6.19","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"6.17.13"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"6.18.2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"6.19"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.5.8"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/70acbc9c77686b7a521af6d7a543dcd9c324cf07"},{"url":"https://git.kernel.org/stable/c/cda077a19f5c8d6ec61e5b97deca203d95e3a422"},{"url":"https://git.kernel.org/stable/c/35501ac3c7d40a7bb9568c2f89d6b56beaf9bed3"}],"title":"coresight: ETR: Fix ETR buffer use-after-free issue","x_generator":{"engine":"bippy-1.2.0"}}}}