CVE-2025-68329

{
  "id": "CVE-2025-68329",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2025-12-22T17:16:00.580",
  "lastModified": "2026-10-19T21:10:00.160",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Fix WARN_ON in tracing_buffers_mmap_close for split VMAs\n\nWhen a VMA is split (e.g., by partial munmap or MAP_FIXED), the kernel\ncalls vm_ops->close on each portion. For trace buffer mappings, this\nresults in ring_buffer_unmap() being called multiple times while\nring_buffer_map() was only called once.\n\nThis causes ring_buffer_unmap() to return -ENODEV on subsequent calls\nbecause user_mapped is already 0, triggering a WARN_ON.\n\nTrace buffer mappings cannot support partial mappings because the ring\nbuffer structure requires the complete buffer including the meta page.\n\nFix this by adding a may_split callback that returns -EINVAL to prevent\nVMA splits entirely."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad:\n\ntracing: Corrección de WARN_ON en tracing_buffers_mmap_close para VMAs divididas\n\nCuando una VMA se divide (por ejemplo, por un munmap parcial o MAP_FIXED), el kernel llama a vm_ops -> close en cada porción. Para los mapeos del búfer de trazas, esto resulta en que ring_buffer_unmap() se llama varias veces, mientras que ring_buffer_map() solo se llamó una vez.\n\nEsto provoca que ring_buffer_unmap() devuelva -ENODEV en llamadas posteriores porque user_mapped ya es 0, lo que activa un WARN_ON.\n\nLos mapeos del búfer de trazas no pueden soportar mapeos parciales porque la estructura del búfer circular requiere el búfer completo, incluyendo la página meta.\n\nEsto se soluciona añadiendo una función de callback may_split que devuelve -EINVAL para evitar por completo las divisiones de VMA."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "kernel/trace/trace.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "cf9f0f7c4c5bb45e7bb270e48bab6f7837825a64",
              "lessThan": "922fdd0b755a84f9933b3ca195f60092b6bb88ee",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "cf9f0f7c4c5bb45e7bb270e48bab6f7837825a64",
              "lessThan": "45053c12c45f0fb8ef6ab95118dd928d2fec0255",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "cf9f0f7c4c5bb45e7bb270e48bab6f7837825a64",
              "lessThan": "b042fdf18e89a347177a49e795d8e5184778b5b6",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "kernel/trace/trace.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "6.10",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "6.10",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.12.61",
              "lessThanOrEqual": "6.12.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.17.11",
              "lessThanOrEqual": "6.17.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.18",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/45053c12c45f0fb8ef6ab95118dd928d2fec0255",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/922fdd0b755a84f9933b3ca195f60092b6bb88ee",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b042fdf18e89a347177a49e795d8e5184778b5b6",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ]
}