coresight: ETR: Fix ETR buffer use-after-free issue
In the Linux kernel, the following vulnerability has been resolved: coresight: ETR: Fix ETR buffer use-after-free issue When ETR is enabled as CS_MODE_SYSFS, if the buffer size is changed and enabled again, currently sysfs_buf will point to the newly allocated memory(buf_new) and free the old memory(buf_old). But the etr_buf that is being used by the ETR remains pointed to buf_old, not updated to buf_new. In this case, it will result in a memory use-after-free issue. Fix this by checking ETR's mode before updating and releasing buf_old, if the mode is CS_MODE_SYSFS, then skip updating and releasing it.
- Products
- Kernel
- Affected versions
- Not specified
- Fixed versions
- 6.12.114, 6.17.13, 6.18.2, 6.6.160
- CVEs
- CVE-2025-68376
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 01:33 UTC · Revision 1
Source evidence
coresight: ETR: Fix ETR buffer use-after-free issue
core-osv · Original sourcePublished 24 Dec 2025, 10:33 UTC
In the Linux kernel, the following vulnerability has been resolved: coresight: ETR: Fix ETR buffer use-after-free issue When ETR is enabled as CS_MODE_SYSFS, if the buffer size is changed and enabled again, currently sysfs_buf will point to the newly allocated memory(buf_new) and free the old memory(buf_old). But the etr_buf that is being used by the ETR remains pointed to buf_old, not updated to buf_new. In this case, it will result in a memory use-after-free issue. Fix this by checking ETR's mode before updating and releasing buf_old, if the mode is CS_MODE_SYSFS, then skip updating and releasing it.
osv:CVE-2025-68376
Kernel
Fixed versions: 6.6.160, 6.12.114, 6.17.13, 6.18.2
Complete source record
{
"id": "5ee8bfb368b796180450eb9701a28294b928d0af004d82da3d3e83d514ac47e6",
"url": "https://osv.dev/vulnerability/CVE-2025-68376",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "coresight: ETR: Fix ETR buffer use-after-free issue",
"summary": "In the Linux kernel, the following vulnerability has been resolved: coresight: ETR: Fix ETR buffer use-after-free issue When ETR is enabled as CS_MODE_SYSFS, if the buffer size is changed and enabled again, currently sysfs_buf will point to the newly allocated memory(buf_new) and free the old memory(buf_old). But the etr_buf that is being used by the ETR remains pointed to buf_old, not updated to buf_new. In this case, it will result in a memory use-after-free issue. Fix this by checking ETR's mode before updating and releasing buf_old, if the mode is CS_MODE_SYSFS, then skip updating and releasing it.",
"evidence": "osv:CVE-2025-68376",
"products": [
{
"name": {
"value": "Kernel",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "6.6.160",
"evidence": "/affected/1/ranges"
},
{
"value": "6.12.114",
"evidence": "/affected/1/ranges"
},
{
"value": "6.17.13",
"evidence": "/affected/1/ranges"
},
{
"value": "6.18.2",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "CVE-2025-68376",
"aliases": [
"CVE-2025-68376"
],
"affected": [
{
"ranges": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "bd2767ec3df2775bc336f441f9068a989ccb919d"
},
{
"fixed": "5d5d130835b417c7bfd6c942f0149e34397d4463"
},
{
"fixed": "4e83434247ff8005a0b9a1ee997864abf8f259ec"
},
{
"fixed": "70acbc9c77686b7a521af6d7a543dcd9c324cf07"
},
{
"fixed": "cda077a19f5c8d6ec61e5b97deca203d95e3a422"
},
{
"fixed": "35501ac3c7d40a7bb9568c2f89d6b56beaf9bed3"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "6.5.8"
},
{
"fixed": "6.6"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "fdd3ceb0001da6768bede9779a0190a42e65c404"
}
]
}
],
"versions": [
"v6.5.13",
"v6.5.12",
"v6.5.11",
"v6.5.10",
"v6.5.9",
"v6.5.8"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-68376.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.6.0"
},
{
"fixed": "6.6.160"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.7.0"
},
{
"fixed": "6.12.114"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.13.0"
},
{
"fixed": "6.17.13"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.18.0"
},
{
"fixed": "6.18.2"
}
]
}
],
"package": {
"name": "Kernel",
"ecosystem": "Linux"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-68376.json"
}
}
],
"modified": "2026-10-28T02:30:25.026179823Z",
"provider": "osv",
"references": [
"https://git.kernel.org/stable/c/35501ac3c7d40a7bb9568c2f89d6b56beaf9bed3",
"https://git.kernel.org/stable/c/4e83434247ff8005a0b9a1ee997864abf8f259ec",
"https://git.kernel.org/stable/c/5d5d130835b417c7bfd6c942f0149e34397d4463",
"https://git.kernel.org/stable/c/70acbc9c77686b7a521af6d7a543dcd9c324cf07",
"https://git.kernel.org/stable/c/cda077a19f5c8d6ec61e5b97deca203d95e3a422",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68376.json",
"https://nvd.nist.gov/vuln/detail/CVE-2025-68376",
"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
],
"provider_metadata": {
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68376.json"
}
},
"related_cves": [
{
"value": "CVE-2025-68376",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 491660,
"published_at": "2025-12-24T10:33:05.503+00:00"
}