CVE-2025-68329

In the Linux kernel, a vulnerability exists in the tracing subsystem where buffer mappings cannot be partially unmapped. When a virtual memory area (VMA) is split (e.g., by munmap or MAP_FIXED), the kernel calls vm_ops->close on each resulting VMA. For trace buffer mappings, this leads to ring_buffer_unmap() being invoked multiple times, while the corresponding ring_buffer_map() was only called once for the original mapping [1].

This mismatch causes subsequent calls to ring_buffer_unmap() to fail with -ENODEV because the user_mapped flag is already cleared, which then triggers a WARN_ON. The root cause is that the trace buffer relies on a complete mapping (including the meta page), and partial unmapping is not supported [1].

An attacker with the ability to partially unmap a trace buffer VMA (e.g., via munmap on only part of the mapping) could cause a kernel warning, potentially leading to a denial of service. No privilege escalation is indicated from the available sources [1].

The fix adds a may_split callback to the VMA operations, which returns -EINVAL to prevent VMA splits entirely for trace buffer mappings. This patch has been applied to the Linux kernel stable tree [1].