CVE-2025-68370: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-68370 is a Linux kernel vulnerability in the CoreSight Trace Memory Controller (TMC) component, caused by a missing event handle in the coresight path during perf mode operation. The flaw results in a kernel paging fault (oops) when using perf record with the CoreSight ETM event source across multiple CPUs. It was published on December 24, 2025, and affects Linux kernel versions introduced from commit 080ee83cc361 up to the patched releases. The CVSS base score is not yet formally assigned, but Feedly estimates severity as Medium with an EPSS score of 0.00017 (Red Hat CVE, Feedly).

The root cause is a missing AUX_EVENT handle in the coresight_path structure, which is required for the TMC (Trace Memory Controller) to retrieve per-CPU AUX events in perf mode (CWE-476: NULL Pointer Dereference / improper pointer handling). When perf record -e cs_etm//k is run across multiple CPUs, the tmc_etr_get_buffer function attempts to dereference an uninitialized or invalid pointer, triggering a kernel paging fault at a virtual address such as 000f6e84934ed19e. The call trace involves tmc_etr_get_buffer+0x30/0x80, catu_enable_hw+0xbc/0x3d0, catu_enable+0x70/0xe0, and coresight_enable_path+0xb0/0x258. The fix adds the perf event handle to coresight_path so dependent devices (e.g., CATU) can access it correctly (Red Hat CVE, Kernel Patch).

Successful exploitation causes a kernel oops (system crash) due to an invalid memory access, resulting in a denial of service on the affected system. The vulnerability is locally triggerable by any user with access to performance monitoring tools (perf), and does not appear to enable privilege escalation or data exfiltration based on current analysis. The impact is limited to availability — specifically, system instability or crash on ARM-based systems with CoreSight hardware tracing support (Red Hat CVE, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is locally exploitable and requires access to the perf tool, which may be restricted on hardened systems. The EPSS score is 0.00017, indicating very low probability of exploitation in the near term, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog (Feedly, Red Hat CVE).

1. Identify a vulnerable system: Confirm the target is running a Linux kernel version between commit 080ee83cc361 and the patched versions (pre-6.17.13, pre-6.18.2, or pre-6.19-rc1) on ARM hardware with CoreSight ETM and CATU support.
2. Obtain local access: Gain local user access to the system with permission to run perf record (may require CAP_PERFMON or equivalent privilege depending on kernel configuration).
3. Trigger the vulnerability: Execute the following command targeting multiple CPUs:

   perf record -e cs_etm//k -C 0-9 dd if=/dev/zero of=/dev/null

4. Observe kernel oops: The kernel will attempt to dereference an invalid pointer in tmc_etr_get_buffer, producing a paging fault at an invalid virtual address and crashing the system (Red Hat CVE, Feedly).

• Logs: Kernel oops messages in /var/log/kern.log or dmesg output containing Unable to handle kernel paging request at virtual address followed by a call trace including tmc_etr_get_buffer, catu_enable_hw, catu_enable, and coresight_enable_path.
• Process: Presence of perf record processes with -e cs_etm//k arguments and multi-CPU targeting (-C flag) in process listings.
• System: Unexpected system reboots or kernel panics on ARM systems with CoreSight hardware, particularly correlated with perf tracing activity.

Patches are available for Linux kernel versions 6.17.13, 6.18.2, and 6.19-rc1, addressing the missing event handle in the coresight path. Users should update to a patched kernel version as the primary remediation. As a temporary workaround, restrict access to performance monitoring tools for untrusted users (e.g., set kernel.perf_event_paranoid to a restrictive value), and avoid running perf record with cs_etm//k across multiple CPUs on unpatched systems (Red Hat CVE, Kernel Patch).