Skip to main content

Linux Kernel CVE-2025-68370

HIGH
2025-12-24 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
5.5 MEDIUM

Local access and tracing privilege give AV:L/PR:L; described impact is a kernel oops (A:H) with no evidenced confidentiality or integrity loss, so C:N/I:N.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 30, 2026 - 07:04 vuln.today
CVE Published
Dec 24, 2025 - 11:16 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

coresight: tmc: add the handle of the event to the path

The handle is essential for retrieving the AUX_EVENT of each CPU and is required in perf mode. It has been added to the coresight_path so that dependent devices can access it from the path when needed.

The existing bug can be reproduced with: perf record -e cs_etm//k -C 0-9 dd if=/dev/zero of=/dev/null

Showing an oops as follows: Unable to handle kernel paging request at virtual address 000f6e84934ed19e

Call trace: tmc_etr_get_buffer+0x30/0x80 [coresight_tmc] (P) catu_enable_hw+0xbc/0x3d0 [coresight_catu] catu_enable+0x70/0xe0 [coresight_catu] coresight_enable_path+0xb0/0x258 [coresight]

AnalysisAI

Local privilege-limited denial of service in the Linux kernel's CoreSight TMC (Trace Memory Controller) driver allows a user with performance-monitoring access to trigger a kernel oops via an invalid pointer dereference in tmc_etr_get_buffer(). The flaw occurs because the perf event handle was not attached to the coresight_path, so dependent devices such as the CATU could not retrieve the per-CPU AUX_EVENT during path enablement. It is reproducible with a standard perf record command against CoreSight ETM tracing; there is no public exploit identified at time of analysis and EPSS is low (0.16%).

Technical ContextAI

CoreSight is Arm's on-chip hardware trace and debug infrastructure, exposed through Linux via perf using the cs_etm// event. The affected component is the TMC (Trace Memory Controller) driver (coresight_tmc), working alongside the CATU (CoreSight Address Translation Unit, coresight_catu) which provides scatter-gather buffer management for the ETR (Embedded Trace Router). The root cause is that coresight_path lacked the perf event 'handle', which is essential for retrieving each CPU's AUX_EVENT in perf mode; when catu_enable_hw() calls into tmc_etr_get_buffer() during coresight_enable_path(), the missing/uninitialized handle leads to an invalid virtual address dereference (kernel paging request), i.e. a NULL/uninitialized-pointer-dereference class defect. CWE was not assigned (N/A) in the input, but the crash signature is consistent with an invalid pointer dereference (CWE-476/CWE-822 family).

Affected ProductsAI

The affected product is the Linux kernel, specifically the CoreSight TMC driver (coresight_tmc) and its interaction with the CoreSight CATU driver (coresight_catu) on Arm platforms that implement CoreSight hardware trace. Exact affected version ranges were not enumerated in the input (no CPE strings and no CWE were provided); the fix is distributed across three stable-tree commits (aaa5abcc9d44d2c8484f779ab46d242d774cabcb, d0c9effd82f2c19b92acd07d357fac5f392d549a, faa8f38f7ccb344ace2c1f364efc70e3a12d32f3) at git.kernel.org, indicating multiple maintained stable branches were patched. Consult your distribution's kernel advisory to map these commits to a fixed package version for your branch.

RemediationAI

Upstream fix available (commits at git.kernel.org, not a single tagged release) - released patched version not independently confirmed from the input; apply the kernel update from your distribution that incorporates commits aaa5abcc9d44d2c8484f779ab46d242d774cabcb, d0c9effd82f2c19b92acd07d357fac5f392d549a, and/or faa8f38f7ccb344ace2c1f364efc70e3a12d32f3 (see https://git.kernel.org/stable/c/aaa5abcc9d44d2c8484f779ab46d242d774cabcb). As a compensating control until patched, restrict who can run CoreSight/perf tracing: set kernel.perf_event_paranoid to a restrictive value (e.g. 2 or higher) and limit CAP_PERFMON/root access so unprivileged users cannot invoke cs_etm perf sessions, accepting the trade-off that legitimate profiling and hardware-trace workflows will be blocked; alternatively, do not load or blacklist the coresight_tmc/coresight_catu modules on systems that do not require hardware tracing, which disables CoreSight trace functionality entirely.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected

Share

CVE-2025-68370 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy