CVE-2025-21778— tracing: Do not allow mmap() of persistent ring buffer
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于tracing未正确处理持久ring buffer的mmap，可能导致崩溃。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1041 · Exfiltration Over C2 ChannelAffected Version Matrix 8
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 9b7bdf6f6ece6ea888cc7d2f02c00b403b66a119< e8dff5f73912513fc9b52ab992d861517c9a9975 |
affected |
9b7bdf6f6ece6ea888cc7d2f02c00b403b66a119< cf5aa560e5c7628b57c928741d7e6a9a0f6f0e67 |
affected | ||
9b7bdf6f6ece6ea888cc7d2f02c00b403b66a119< 129fe718819cc5e24ea2f489db9ccd4371f0c6f6 |
affected | ||
6.12 |
affected | ||
< 6.12 |
unaffected | ||
6.12.16≤ 6.12.* |
unaffected | ||
6.13.4≤ 6.13.* |
unaffected | ||
6.14≤ * |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-21778
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
tracing: Do not allow mmap() of persistent ring buffer
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
tracing: Do not allow mmap() of persistent ring buffer
When trying to mmap a trace instance buffer that is attached to
reserve_mem, it would crash:
BUG: unable to handle page fault for address: ffffe97bd00025c8
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 2862f3067 P4D 2862f3067 PUD 0
Oops: Oops: 0000 [#1] PREEMPT_RT SMP PTI
CPU: 4 UID: 0 PID: 981 Comm: mmap-rb Not tainted 6.14.0-rc2-test-00003-g7f1a5e3fbf9e-dirty #233
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:validate_page_before_insert+0x5/0xb0
Code: e2 01 89 d0 c3 cc cc cc cc 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 <48> 8b 46 08 a8 01 75 67 66 90 48 89 f0 8b 50 34 85 d2 74 76 48 89
RSP: 0018:ffffb148c2f3f968 EFLAGS: 00010246
RAX: ffff9fa5d3322000 RBX: ffff9fa5ccff9c08 RCX: 00000000b879ed29
RDX: ffffe97bd00025c0 RSI: ffffe97bd00025c0 RDI: ffff9fa5ccff9c08
RBP: ffffb148c2f3f9f0 R08: 0000000000000004 R09: 0000000000000004
R10: 0000000000000000 R11: 0000000000000200 R12: 0000000000000000
R13: 00007f16a18d5000 R14: ffff9fa5c48db6a8 R15: 0000000000000000
FS: 00007f16a1b54740(0000) GS:ffff9fa73df00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffe97bd00025c8 CR3: 00000001048c6006 CR4: 0000000000172ef0
Call Trace:
<TASK>
? __die_body.cold+0x19/0x1f
? __die+0x2e/0x40
? page_fault_oops+0x157/0x2b0
? search_module_extables+0x53/0x80
? validate_page_before_insert+0x5/0xb0
? kernelmode_fixup_or_oops.isra.0+0x5f/0x70
? __bad_area_nosemaphore+0x16e/0x1b0
? bad_area_nosemaphore+0x16/0x20
? do_kern_addr_fault+0x77/0x90
? exc_page_fault+0x22b/0x230
? asm_exc_page_fault+0x2b/0x30
? validate_page_before_insert+0x5/0xb0
? vm_insert_pages+0x151/0x400
__rb_map_vma+0x21f/0x3f0
ring_buffer_map+0x21b/0x2f0
tracing_buffers_mmap+0x70/0xd0
__mmap_region+0x6f0/0xbd0
mmap_region+0x7f/0x130
do_mmap+0x475/0x610
vm_mmap_pgoff+0xf2/0x1d0
ksys_mmap_pgoff+0x166/0x200
__x64_sys_mmap+0x37/0x50
x64_sys_call+0x1670/0x1d70
do_syscall_64+0xbb/0x1d0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The reason was that the code that maps the ring buffer pages to user space
has:
page = virt_to_page((void *)cpu_buffer->subbuf_ids[s]);
And uses that in:
vm_insert_pages(vma, vma->vm_start, pages, &nr_pages);
But virt_to_page() does not work with vmap()'d memory which is what the
persistent ring buffer has. It is rather trivial to allow this, but for
now just disable mmap() of instances that have their ring buffer from the
reserve_mem option.
If an mmap() is performed on a persistent buffer it will return -ENODEV
just like it would if the .mmap field wasn't defined in the
file_operations structure.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于tracing未正确处理持久ring buffer的mmap，可能导致崩溃。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2025-21778
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-21778
请登录查看更多情报信息。
Patches & Fixes for CVE-2025-21778 (3)
Same Patch Batch · Linux · 2025-02-27 · 177 CVEs total
| CVE-2025-21805 | 9.8 CRITICAL | RDMA/rtrs: Add missing deinit() call |
| CVE-2025-21796 | 9.8 CRITICAL | nfsd: clear acl_access/acl_default after releasing them |
| CVE-2025-21707 | 9.8 CRITICAL | mptcp: consolidate suboption status |
| CVE-2025-21748 | 9.8 CRITICAL | ksmbd: fix integer overflows on 32 bit systems |
| CVE-2024-58006 | 9.6 CRITICAL | PCI: dwc: ep: Prevent changing BAR size/flags in pci_epc_set_bar() |
| CVE-2024-57999 | 8.8 HIGH | powerpc/pseries/iommu: IOMMU incorrectly marks MMIO range in DDW |
| CVE-2025-21735 | 8.8 HIGH | NFC: nci: Add bounds checking in nci_hci_create_pipe() |
| CVE-2024-57997 | 8.8 HIGH | wifi: wcn36xx: fix channel survey memory allocation size |
| CVE-2024-57995 | 8.8 HIGH | wifi: ath12k: fix read pointer after free in ath12k_mac_assign_vif_to_vdev() |
| CVE-2025-21710 | 8.2 HIGH | tcp: correct handling of extreme memory squeeze |
| CVE-2025-21766 | 8.1 HIGH | ipv4: use RCU protection in __ip_rt_update_pmtu() |
| CVE-2024-57973 | 8.1 HIGH | rdma/cxgb4: Prevent potential integer overflow on 32bit |
| CVE-2025-21762 | 8.1 HIGH | arp: use RCU protection in arp_xmit() |
| CVE-2025-21765 | 8.1 HIGH | ipv6: use RCU protection in ip6_default_advmss() |
| CVE-2025-21760 | 8.1 HIGH | ndisc: extend RCU protection in ndisc_send_skb() |
| CVE-2025-21764 | 7.8 HIGH | ndisc: use RCU protection in ndisc_alloc_skb() |
| CVE-2024-58019 | 7.8 HIGH | nvkm/gsp: correctly advance the read pointer of GSP message queue |
| CVE-2024-58008 | 7.8 HIGH | KEYS: trusted: dcp: fix improper sg use with CONFIG_VMAP_STACK=y |
| CVE-2024-58010 | 7.8 HIGH | binfmt_flat: Fix integer overflow bug on 32 bit systems |
| CVE-2024-58013 | 7.8 HIGH | Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync |
Showing top 20 of 177 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2026-99087
dm-integrity: fix NULL pointer dereference when the 'R' flag -
CVE-2026-99086
dm-integrity: validate the superblock on resume -
CVE-2026-99084
readdir: take no inode lock on an immutable directory -
CVE-2026-99085
sched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit -
CVE-2026-99083
ksmbd: fix heap out-of-bounds write in krb5_authenticate()
Same vendor: Linux
-
CVE-2026-99087
dm-integrity: fix NULL pointer dereference when the 'R' flag -
CVE-2026-99086
dm-integrity: validate the superblock on resume -
CVE-2026-99084
readdir: take no inode lock on an immutable directory -
CVE-2026-99085
sched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit -
CVE-2026-99083
ksmbd: fix heap out-of-bounds write in krb5_authenticate()
V. Comments for CVE-2025-21778
No comments yet