CVE-2025-68186

Vulnerability

In the Linux kernel, the ring_buffer_map_get_reader() function is stricter than other reader helpers: it warns when rb_get_reader_page() returns NULL. The fix recognizes that if the reader has caught up to the writer but the current reader page still contains unread data, rb_get_reader_page() correctly returns NULL because there is no new page to obtain. The original code did not account for this situation, causing a spurious warning when tracing threads race normally.

Exploitation

The warning is triggered by a legitimate runtime condition—no special privileges or network access are needed. When a tracing buffer reader consumes data at a rate similar to the writer, it can reach a state where the reader page holds unconsumed records and no page advancement is required. The check that warns on NULL return from rb_get_reader_page() then fires, producing a kernel warning stack trace.

Impact

A kernel warning floods the system log and may cause a user-visible panic if the system is configured to panic_on_warn. This can lead to a denial of service on any system using the ring buffer for tracing, including production performance-monitoring deployments. No attacker-controlled data corruption or privilege escalation occurs; the bug is purely a false-positive diagnostic.

Mitigation

The fix [1][2] adds a check for the reader-caught-up scenario before issuing the warning. The patch has been merged into the stable Linux kernel tree. Users should apply the update to their kernel version as soon as it becomes available.