GHSA-6JCW-GRC8-H79F
Vulnerability from github – Published: 2025-12-22 18:30 – Updated: 2025-12-22 18:30In the Linux kernel, the following vulnerability has been resolved:
tracing: Fix WARN_ON in tracing_buffers_mmap_close for split VMAs
When a VMA is split (e.g., by partial munmap or MAP_FIXED), the kernel calls vm_ops->close on each portion. For trace buffer mappings, this results in ring_buffer_unmap() being called multiple times while ring_buffer_map() was only called once.
This causes ring_buffer_unmap() to return -ENODEV on subsequent calls because user_mapped is already 0, triggering a WARN_ON.
Trace buffer mappings cannot support partial mappings because the ring buffer structure requires the complete buffer including the meta page.
Fix this by adding a may_split callback that returns -EINVAL to prevent VMA splits entirely.
{
"affected": [],
"aliases": [
"CVE-2025-68329"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-22T17:16:00Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Fix WARN_ON in tracing_buffers_mmap_close for split VMAs\n\nWhen a VMA is split (e.g., by partial munmap or MAP_FIXED), the kernel\ncalls vm_ops-\u003eclose on each portion. For trace buffer mappings, this\nresults in ring_buffer_unmap() being called multiple times while\nring_buffer_map() was only called once.\n\nThis causes ring_buffer_unmap() to return -ENODEV on subsequent calls\nbecause user_mapped is already 0, triggering a WARN_ON.\n\nTrace buffer mappings cannot support partial mappings because the ring\nbuffer structure requires the complete buffer including the meta page.\n\nFix this by adding a may_split callback that returns -EINVAL to prevent\nVMA splits entirely.",
"id": "GHSA-6jcw-grc8-h79f",
"modified": "2025-12-22T18:30:25Z",
"published": "2025-12-22T18:30:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68329"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/45053c12c45f0fb8ef6ab95118dd928d2fec0255"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/922fdd0b755a84f9933b3ca195f60092b6bb88ee"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b042fdf18e89a347177a49e795d8e5184778b5b6"
}
],
"schema_version": "1.4.0",
"severity": []
}
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.