VulnerabilityPublished 24 Dec 2025Updated 21 Oct 2026

CVE-2025-68376: Linux kernel · coresight: ETR: Fix ETR buffer use-after-free issue

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in cda077a19f5c8d6ec61e5b97deca203d95e3a422 : update Linux kernel when convenient.

Data as of 26 Oct 2026, 10:24 UTC

Severity

Unrated

Rated by Threat Radar · No CVSS score from NVD or the CNA

EPSS: 0.2% chance of exploitation in 30 days – higher than 11% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in cda077a19f5c8d6ec61e5b97deca203d95e3a422, 35501ac3c7d40a7bb9568c2f89d6b56beaf9bed3, 70acbc9c77686b7a521af6d7a543dcd9c324cf07 +3

Exploitation evidence

Disclosed: evidence found.
CVE published 24 Dec 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected >=6.5.8 <6.6	Fixed in cda077a19f5c8d6ec61e5b97deca203d95e3a422 35501ac3c7d40a7bb9568c2f89d6b56beaf9bed3 70acbc9c77686b7a521af6d7a543dcd9c324cf07 6.6 5d5d130835b417c7bfd6c942f0149e34397d4463 4e83434247ff8005a0b9a1ee997864abf8f259ec
LinuxLinux	Affected =6.6	Fixed in–

Description

In the Linux kernel, the following vulnerability has been resolved: coresight: ETR: Fix ETR buffer use-after-free issue When ETR is enabled as CS_MODE_SYSFS, if the buffer size is changed and enabled again, currently sysfs_buf will point to the newly allocated memory(buf_new) and free the old memory(buf_old). But the etr_buf that is being used by the ETR remains pointed to buf_old, not updated to buf_new. In this case, it will result in a memory use-after-free issue. Fix this by checking ETR's mode before updating and releasing buf_old, if the mode is CS_MODE_SYSFS, then skip updating and releasing it.

References

Community reviews

Loading reviews…