CVE-2025-37923: tracing: Fix oob write in trace_seq_to_buffer()
In the Linux kernel, the following vulnerability has been resolved:
tracing: Fix oob write in traceseqtobuffer()
syzbot reported this bug: ================================================================== BUG: KASAN: slab-out-of-bounds in traceseqtobuffer kernel/trace/trace.c:1830 [inline] BUG: KASAN: slab-out-of-bounds in tracingsplicereadpipe+0x6be/0xdd0 kernel/trace/trace.c:6822 Write of size 4507 at addr ffff888032b6b000 by task syz.2.320/7260
CPU: 1 UID: 0 PID: 7260 Comm: syz.2.320 Not tainted 6.15.0-rc1-syzkaller-00301-g3bde70a2c827 #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 Call Trace: <TASK> dumpstack lib/dumpstack.c:94 [inline] dumpstacklvl+0x116/0x1f0 lib/dumpstack.c:120 printaddressdescription mm/kasan/report.c:408 [inline] printreport+0xc3/0x670 mm/kasan/report.c:521 kasanreport+0xe0/0x110 mm/kasan/report.c:634 checkregioninline mm/kasan/generic.c:183 [inline] kasancheckrange+0xef/0x1a0 mm/kasan/generic.c:189 asanmemcpy+0x3c/0x60 mm/kasan/shadow.c:106 traceseqtobuffer kernel/trace/trace.c:1830 [inline] tracingsplicereadpipe+0x6be/0xdd0 kernel/trace/trace.c:6822 .... ==================================================================
It has been reported that traceseqtobuffer() tries to copy more data than PAGESIZE to buf. Therefore, to prevent this, we should use the smaller of traceseqused(&iter->seq) and PAGESIZE as an argument.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-37923?
CVE-2025-37923 has a high severity level due to an out-of-bounds write vulnerability in the Linux kernel.
How do I fix CVE-2025-37923?
To fix CVE-2025-37923, update your Linux kernel to version 6.15.0 or later.
Which software is affected by CVE-2025-37923?
CVE-2025-37923 affects the Linux Kernel version 6.15.0-rc1.
What type of vulnerability is CVE-2025-37923?
CVE-2025-37923 is an out-of-bounds write vulnerability identified in the trace_seq_to_buffer function.
Is CVE-2025-37923 being actively exploited?
As of the current information, there have been no reports of active exploitation of CVE-2025-37923.