GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-38101 (GCVE-0-2025-38101)

Vulnerability from cvelistv5 – Published: 2025-07-03 08:35 – Updated: 2026-08-05 11:59
VLAI
Title
ring-buffer: Fix buffer locking in ring_buffer_subbuf_order_set()
Summary
In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix buffer locking in ring_buffer_subbuf_order_set() Enlarge the critical section in ring_buffer_subbuf_order_set() to ensure that error handling takes place with per-buffer mutex held, thus preventing list corruption and other concurrency-related issues.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: f9b94daa542a8d2532f0930f01cd9aec2d19621b , < e09c0600beea469b3ebf974464e526a02d59ad62 (git)
Affected: f9b94daa542a8d2532f0930f01cd9aec2d19621b , < 0fc9a295cd8e59c3636e97395e7c74a9c89fee42 (git)
Affected: f9b94daa542a8d2532f0930f01cd9aec2d19621b , < 40ee2afafc1d9fe3aa44a6fbe440d78a5c96a72e (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.8
Unaffected: 0 , < 6.8 (semver)
Unaffected: 6.12.34 , ≤ 6.12.* (semver)
Unaffected: 6.15.3 , ≤ 6.15.* (semver)
Unaffected: 6.16 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/ring_buffer.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e09c0600beea469b3ebf974464e526a02d59ad62",
              "status": "affected",
              "version": "f9b94daa542a8d2532f0930f01cd9aec2d19621b",
              "versionType": "git"
            },
            {
              "lessThan": "0fc9a295cd8e59c3636e97395e7c74a9c89fee42",
              "status": "affected",
              "version": "f9b94daa542a8d2532f0930f01cd9aec2d19621b",
              "versionType": "git"
            },
            {
              "lessThan": "40ee2afafc1d9fe3aa44a6fbe440d78a5c96a72e",
              "status": "affected",
              "version": "f9b94daa542a8d2532f0930f01cd9aec2d19621b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/ring_buffer.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.34",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.3",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nring-buffer: Fix buffer locking in ring_buffer_subbuf_order_set()\n\nEnlarge the critical section in ring_buffer_subbuf_order_set() to\nensure that error handling takes place with per-buffer mutex held,\nthus preventing list corruption and other concurrency-related issues."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable function is reached only through a local `write()` to the tracefs file `buffer_subbuf_size_kb` (via `buffer_subbuf_size_write()`), with the error path armed by a local `mmap()` of `per_cpu/cpuN/trace_pipe_raw`. No remote or network-supplied data reaches `ring_buffer_subbuf_order_set()`.\nAC:L - The attacker owns both sides of the race \u2014 two threads writing `buffer_subbuf_size_kb` concurrently, with no `trace_types_lock` serializing `buffer_subbuf_size_write()` \u2014 and deterministically forces the unlocked `error:` path by mmap\u0027ing a later CPU\u0027s `trace_pipe_raw` so `cpu_buffer-\u003emapped` yields `-EBUSY` after earlier CPUs already allocated `new_pages`. The window spans a sleeping GFP_KERNEL allocation loop and a multi-page free loop whose length the attacker sets via `buffer_size_kb` and CPU count, and the attempt can be retried indefinitely.\nPR:L - No capability check exists anywhere on the path \u2014 `tracing_check_open_get_tr()` only tests `LOCKDOWN_TRACEFS` and `tracing_disabled` \u2014 so access is governed purely by tracefs DAC, which Android (`shell`, `traced_probes`/Perfetto), ChromeOS and observability/embedded deployments routinely delegate to ordinary non-root accounts and tracing groups. This matches the CNA\u0027s existing tracefs precedent (CVE-2025-38267, CVE-2025-68329, both PR:L).\nUI:N - The attacker performs the `mmap()` of `trace_pipe_raw` and both concurrent writes to `buffer_subbuf_size_kb` entirely from its own threads. No victim action, mount, or file open by another user is involved.\nS:U - The list corruption and freed-page reuse occur in the kernel\u0027s own ring-buffer allocations and stay within the host kernel\u0027s security authority. No VM, IOMMU, container, or sandbox boundary is crossed.\nC:H - The race leaves the live `cpu_buffer-\u003epages` list pointing at `struct buffer_page` objects and order-N data pages that the other thread has already handed back via `kfree()`/`free_pages()`, so the ring buffer keeps reading from memory that the slab and page allocators have reissued to other kernel users. Reading `trace` or `trace_pipe_raw` then discloses the contents of those reallocated kernel objects.\nI:H - Concurrent `list_del_init()` against a re-initialized head produces list corruption plus double-free of both a kmalloc\u0027d `struct buffer_page` and its `free_pages()` backing allocation \u2014 a classic heap-corruption primitive. Because `trace_marker` writes attacker-chosen bytes directly into ring-buffer data pages, the attacker can overwrite the freed-and-reallocated memory with controlled content, giving a write primitive usable for control-flow hijack.\nA:H - The corrupted linked list and double-free reliably oops the kernel \u2014 immediately under `CONFIG_DEBUG_LIST`, which turns the bad `__list_del_entry()` into a BUG, and otherwise through the subsequent `rb_check_pages()`/`rb_head_page_deactivate()` walk over freed pages. This was the syzbot-reported failure mode and the attacker can repeat it at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:59:32.011Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e09c0600beea469b3ebf974464e526a02d59ad62"
        },
        {
          "url": "https://git.kernel.org/stable/c/0fc9a295cd8e59c3636e97395e7c74a9c89fee42"
        },
        {
          "url": "https://git.kernel.org/stable/c/40ee2afafc1d9fe3aa44a6fbe440d78a5c96a72e"
        }
      ],
      "title": "ring-buffer: Fix buffer locking in ring_buffer_subbuf_order_set()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38101",
    "datePublished": "2025-07-03T08:35:10.844Z",
    "dateReserved": "2025-04-16T04:51:23.985Z",
    "dateUpdated": "2026-08-05T11:59:32.011Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38101",
      "date": "2026-09-19",
      "epss": "0.00172",
      "percentile": "0.0701"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "kernel/trace/ring_buffer.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "e09c0600beea469b3ebf974464e526a02d59ad62",
                    "status": "affected",
                    "version": "f9b94daa542a8d2532f0930f01cd9aec2d19621b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0fc9a295cd8e59c3636e97395e7c74a9c89fee42",
                    "status": "affected",
                    "version": "f9b94daa542a8d2532f0930f01cd9aec2d19621b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "40ee2afafc1d9fe3aa44a6fbe440d78a5c96a72e",
                    "status": "affected",
                    "version": "f9b94daa542a8d2532f0930f01cd9aec2d19621b",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "kernel/trace/ring_buffer.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.8"
                  },
                  {
                    "lessThan": "6.8",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.34",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.15.*",
                    "status": "unaffected",
                    "version": "6.15.3",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.16",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "15BC1D57-68F1-439E-BE58-136CEB32896A",
                    "versionEndExcluding": "6.12.34",
                    "versionStartIncluding": "6.8",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "0541C761-BD5E-4C1A-8432-83B375D7EB92",
                    "versionEndExcluding": "6.15.3",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nring-buffer: Fix buffer locking in ring_buffer_subbuf_order_set()\n\nEnlarge the critical section in ring_buffer_subbuf_order_set() to\nensure that error handling takes place with per-buffer mutex held,\nthus preventing list corruption and other concurrency-related issues."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ring-buffer: Se corrige el bloqueo del b\u00fafer en ring_buffer_subbuf_order_set() Se ampl\u00eda la secci\u00f3n cr\u00edtica en ring_buffer_subbuf_order_set() para garantizar que el manejo de errores se realice con el mutex por b\u00fafer retenido, evitando as\u00ed la corrupci\u00f3n de listas y otros problemas relacionados con la concurrencia."
          }
        ],
        "id": "CVE-2025-38101",
        "lastModified": "2026-07-30T06:22:50.810",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2025-07-03T09:15:23.573",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/0fc9a295cd8e59c3636e97395e7c74a9c89fee42"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/40ee2afafc1d9fe3aa44a6fbe440d78a5c96a72e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/e09c0600beea469b3ebf974464e526a02d59ad62"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-787"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T09:18:00+00:00",
      "cve": "CVE-2025-38101",
      "id": "CVE-2025-38101",
      "initial_release_date": "2025-07-03T00:00:00+00:00",
      "product_status:known_affected": "104",
      "product_status:known_not_affected": "170",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel: Privilege escalation or denial of service due to improper buffer locking in ring-buffer",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38101.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.