CVE-2025-68376 coresight: ETR: Fix ETR buffer use-after-free issue
A use-after-free vulnerability in the Linux kernel ETR driver allows local attackers with high privileges to execute arbitrary code or escalate privileges.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-68376?
CVE-2025-68376 is an use after free vulnerability in Linux, published on 24 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
coresight: ETR: Fix ETR buffer use-after-free issue
When ETR is enabled as CS_MODE_SYSFS, if the buffer size is changed and enabled again, currently sysfs_buf will point to the newly allocated memory(buf_new) and free the old memory(buf_old). But the etr_buf that is being used by the ETR remains pointed to buf_old, not updated to buf_new. In this case, it will result in a memory use-after-free issue.
Fix this by checking ETR's mode before updating and releasing buf_old, if the mode is CS_MODE_SYSFS, then skip updating and releasing it.
Which versions are affected by CVE-2025-68376?
How do I fix CVE-2025-68376?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2025-68376 being exploited?
There is no known exploitation of CVE-2025-68376 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2025-68376, DEBIAN-CVE-2025-68376, GHSA-cpp9-j2fg-pjvm, ROOT-OS-DEBIAN-13-CVE-2025-68376, ROOT-OS-UBUNTU-2404-CVE-2025-68376, UBUNTU-CVE-2025-68376.