CVE-2025-68376
Description
In the Linux kernel, the following vulnerability has been resolved:
coresight: ETR: Fix ETR buffer use-after-free issue
When ETR is enabled as CS_MODE_SYSFS, if the buffer size is changed and enabled again, currently sysfs_buf will point to the newly allocated memory(buf_new) and free the old memory(buf_old). But the etr_buf that is being used by the ETR remains pointed to buf_old, not updated to buf_new. In this case, it will result in a memory use-after-free issue.
Fix this by checking ETR's mode before updating and releasing buf_old, if the mode is CS_MODE_SYSFS, then skip updating and releasing it.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Use-after-free in Linux kernel coresight ETR driver occurs when buffer size is changed in sysfs mode, fixed by checking mode before memory update.
Vulnerability
In the Linux kernel's coresight ETR (Embedded Trace Router) driver, a use-after-free vulnerability exists when the device is operated in sysfs mode (CS_MODE_SYSFS). If a user changes the buffer size via sysfs and then re-enables the ETR, the driver allocates a new buffer (buf_new) and frees the old buffer (buf_old). However, the hardware's active buffer pointer (etr_buf) is not updated, still pointing to the freed memory. This leads to a use-after-free condition when the ETR continues to use the old buffer [1].
Exploitation
An attacker with local access and the ability to configure the coresight ETR via sysfs can trigger this bug. The attack requires changing the buffer size while the ETR is enabled, then re-enabling it. No special privileges beyond root or access to the sysfs interfaces are needed, but the attacker must have write permissions to the relevant sysfs files for the ETR device.
Impact
A use-after-free can lead to memory corruption, potentially allowing an attacker to escalate privileges or cause a denial of service (system crash). The vulnerability could be exploited to execute arbitrary code in kernel context, depending on the system's memory layout and mitigations.
Mitigation
The vulnerability is fixed in the Linux kernel by commit 35501ac3c7d4 ("coresight: ETR: Fix ETR buffer use-after-free issue"). The fix ensures that when the ETR is in sysfs mode, the driver does not release or update the old buffer prematurely. Systems with updated kernels are not affected. No workaround other than applying the patch is available.
AI Insight generated on May 19, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
3News mentions
0No linked articles in our index yet.