CVE-2025-68370 coresight: tmc: add the handle of the event to the path
A missing event handle in the Linux kernel Coresight TMC driver causes a null pointer dereference and kernel oops during performance recording.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-68370?
CVE-2025-68370 is a high-severity vulnerability in Linux, published on 24 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
coresight: tmc: add the handle of the event to the path
The handle is essential for retrieving the AUX_EVENT of each CPU and is required in perf mode. It has been added to the coresight_path so that dependent devices can access it from the path when needed.
The existing bug can be reproduced with: perf record -e cs_etm//k -C 0-9 dd if=/dev/zero of=/dev/null
Showing an oops as follows: Unable to handle kernel paging request at virtual address 000f6e84934ed19e
Call trace: tmc_etr_get_buffer+0x30/0x80 [coresight_tmc] (P) catu_enable_hw+0xbc/0x3d0 [coresight_catu] catu_enable+0x70/0xe0 [coresight_catu] coresight_enable_path+0xb0/0x258 [coresight]
Which versions are affected by CVE-2025-68370?
How do I fix CVE-2025-68370?
Apply the vendor's patch.
Is CVE-2025-68370 being exploited?
There is no known exploitation of CVE-2025-68370 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2025-68370, DEBIAN-CVE-2025-68370, GHSA-3crq-qf2v-x94m, UBUNTU-CVE-2025-68370.