CVE-2025-68329

tracing: Fix WARN_ON in tracing_buffers_mmap_close for split VMAs

State
Published
Severity
Not scored
Published
Dec 22, 2025
Updated
May 11, 2026
Reserved
Dec 16, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

tracing: Fix WARN_ON in tracing_buffers_mmap_close for split VMAs

When a VMA is split (e.g., by partial munmap or MAP_FIXED), the kernel calls vm_ops->close on each portion. For trace buffer mappings, this results in ring_buffer_unmap() being called multiple times while ring_buffer_map() was only called once.

This causes ring_buffer_unmap() to return -ENODEV on subsequent calls because user_mapped is already 0, triggering a WARN_ON.

Trace buffer mappings cannot support partial mappings because the ring buffer structure requires the complete buffer including the meta page.

Fix this by adding a may_split callback that returns -EINVAL to prevent VMA splits entirely.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • cf9f0f7c4c5bb45e7bb270e48bab6f7837825a64 to before 922fdd0b755a84f9933b3ca195f60092b6bb88eeAffected
  • cf9f0f7c4c5bb45e7bb270e48bab6f7837825a64 to before 45053c12c45f0fb8ef6ab95118dd928d2fec0255Affected
  • cf9f0f7c4c5bb45e7bb270e48bab6f7837825a64 to before b042fdf18e89a347177a49e795d8e5184778b5b6Affected
LinuxLinux
  • 6.10Affected
  • before 6.10Not affected
  • 6.12.61 through 6.12.*Not affected
  • 6.17.11 through 6.17.*Not affected
  • 6.18 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.