LiveActive security incident?Get immediate response
CVE Record

CVE-2025-37923: tracing: Fix oob write in trace_seq_to_buffer()

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix oob write in trace_seq_to_buffer() syzbot reported this bug: ================================================================== BUG: KASAN: slab-out-of-bounds in trace_seq_to_buffer kernel/trace/trace.c:1830 [inline] BUG: KASAN: slab-out-of-bounds in tracing_splice_read_pipe+0x6be/0xdd0 kernel/trace/trace.c:6822 Write of size 4507 at addr ffff888032b6b000 by task syz.2.320/7260 CPU: 1 UID: 0 PID: 7260 Comm: syz.2.320 Not tainted 6.15.0-rc1-syzkaller-00301-g3bde70a2c827 #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:408 [inline] print_report+0xc3/0x670 mm/kasan/report.c:521 kasan_report+0xe0/0x110 mm/kasan/report.c:634 check_region_inline mm/kasan/generic.c:183 [inline] kasan_check_range+0xef/0x1a0 mm/kasan/generic.c:189 __asan_memcpy+0x3c/0x60 mm/kasan/shadow.c:106 trace_seq_to_buffer kernel/trace/trace.c:1830 [inline] tracing_splice_read_pipe+0x6be/0xdd0 kernel/trace/trace.c:6822 .... ================================================================== It has been reported that trace_seq_to_buffer() tries to copy more data than PAGE_SIZE to buf. Therefore, to prevent this, we should use the smaller of trace_seq_used(&iter->seq) and PAGE_SIZE as an argument.

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A flaw in Linux kernel tracing can copy more data than fits in a page-sized buffer, writing outside allocated memory. A local attacker with limited privileges may be able to trigger kernel memory corruption, potentially affecting confidentiality, integrity, and availability. The supplied evidence does not demonstrate successful malicious exploitation.

Executive priority

Treat this as high-priority kernel maintenance, particularly for shared or multi-user Linux systems. It is not remotely exploitable according to the supplied vector, reducing immediate internet-facing urgency. Still, kernel memory corruption can have severe consequences, so affected systems should receive vendor updates promptly.

Technical view

trace_seq_to_buffer() could pass more than PAGE_SIZE bytes to a page-sized destination during tracing_splice_read_pipe(), causing a slab out-of-bounds write. KASAN detected the condition in a syzkaller test. The upstream correction caps the copy length at the smaller of trace_seq_used() and PAGE_SIZE.

Likely exposure

Exposure is limited to systems running an affected Linux kernel where a local, low-privileged user can reach the vulnerable tracing path. Network exposure alone is insufficient. The supplied version data spans multiple kernel lines, so distribution package status and applicable stable-branch commits must be checked.

Exploitation context

The CVSS vector describes a local, low-complexity attack requiring low privileges and no user interaction. This CVE is not listed as KEV, and the supplied sources provide no evidence of active exploitation or public weaponization. The syzbot report demonstrates the bug, not malicious exploitation.

Researcher notes

The report records a 4,507-byte write on a 6.15-rc1 syzkaller build through tracing_splice_read_pipe(). Multiple stable-branch commits are supplied, indicating backports across kernel lines. Determine remediation through distribution advisories and commit ancestry rather than comparing only upstream version numbers.

Mitigation direction

  • Install the Linux kernel update supplied by your distribution or vendor that includes the applicable upstream fix.
  • Reboot into the updated kernel and remove vulnerable kernels from normal boot selection.
  • If updating is delayed, consult vendor guidance; the supplied sources name no standalone workaround.

Validation and detection

  • Inventory running kernel and distribution package versions across servers, appliances, container hosts, and developer systems.
  • Confirm vendor changelogs or kernel source contain the stable fix applicable to each deployed kernel branch.
  • After reboot, verify every system runs the remediated kernel, not merely an installed update.
  • Review kernel and KASAN logs for tracing-related out-of-bounds reports or unexplained crashes.
Prepared
Confidence
medium
Sources
12

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-37923 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
1ADP providers
11Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2025-37923Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux3c56819b14b00dd449bd776303e61f8532fad09f, 3c56819b14b00dd449bd776303e61f8532fad09f, 3c56819b14b00dd449bd776303e61f8532fad09f, 3c56819b14b00dd449bd776303e61f8532fad09f, 3c56819b14b00dd449bd776303e61f8532fad09f, 3c56819b14b00dd449bd776303e61f8532fad09f, 3c56819b14b00dd449bd776303e61f8532fad09f, 3c56819b14b00dd449bd776303e61f8532fad09funaffected
LinuxLinux2.6.30, 0, 5.4.294, 5.10.238, 5.15.182, 6.1.138, 6.6.90, 6.12.28, 6.14.6, 6.15affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.