CVE-2025-68376: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68376 is a use-after-free vulnerability in the Linux kernel's CoreSight ETR (Embedded Trace Router) subsystem. When ETR is operating in CS_MODE_SYSFS mode and the buffer size is changed before re-enabling the device, the sysfs_buf pointer is updated to newly allocated memory (buf_new) while the old buffer (buf_old) is freed — but the ETR's internal etr_buf pointer still references the freed buf_old, resulting in a use-after-free condition. The vulnerability was published on December 24, 2025, and affects Linux kernel versions starting from commit bd2767ec3df2 up to the fixes applied in stable branches. Feedly estimates the severity as HIGH, with an EPSS score of 0.00017 (Feedly, ENISA EUVD).

The root cause is a use-after-free (CWE-416) in the CoreSight ETR driver (drivers/hwtracing/coresight/). When a user changes the ETR buffer size via sysfs while the ETR is active in CS_MODE_SYSFS mode, the driver allocates a new buffer (buf_new), updates sysfs_buf to point to it, and frees the old buffer (buf_old). However, the ETR hardware's active etr_buf pointer is not updated and continues to reference the now-freed buf_old memory. The fix checks the ETR's current mode before releasing buf_old: if the mode is CS_MODE_SYSFS, the update and release of buf_old are skipped to prevent the dangling pointer condition. Patches are available in the stable kernel tree at commits 70acbc9c, cda077a1, and 35501ac3 (Kernel Git, Kernel Git, Kernel Git).

Successful exploitation of this use-after-free vulnerability could allow a local attacker with access to the CoreSight sysfs interface to corrupt kernel memory, potentially leading to privilege escalation, kernel crashes (denial of service), or arbitrary code execution in kernel context. The vulnerability is confined to systems with CoreSight ETR hardware (typically ARM-based embedded or mobile platforms) and requires local access to the sysfs interface to trigger the buffer size change sequence. Data integrity and system availability are the primary concerns, as kernel memory corruption can destabilize the entire system (Feedly).

Apply the upstream Linux kernel patches that fix the ETR buffer use-after-free issue. The fixes have been backported to stable branches and are available at kernel commits 70acbc9c (targeting one stable branch), cda077a19f5c (another stable branch), and 35501ac3c7d4 (a third stable branch), with patched versions including Linux 6.17.13, 6.18.2, and 6.19-rc1. Users on affected kernel versions should update to a patched release as soon as their distribution makes it available. As a temporary workaround, restricting unprivileged user access to the CoreSight sysfs interface (e.g., via appropriate file permissions or disabling the CoreSight ETR driver if not needed) can reduce exposure (Kernel Git, Kernel Git, Kernel Git).