LiveActive security incident?Get immediate response
CVE Record

CVE-2025-40060: coresight: trbe: Return NULL pointer for allocation failures

In the Linux kernel, the following vulnerability has been resolved: coresight: trbe: Return NULL pointer for allocation failures When the TRBE driver fails to allocate a buffer, it currently returns the error code "-ENOMEM". However, the caller etm_setup_aux() only checks for a NULL pointer, so it misses the error. As a result, the driver continues and eventually causes a kernel panic. Fix this by returning a NULL pointer from arm_trbe_alloc_buffer() on allocation failures. This allows that the callers can properly handle the failure.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2025-40060 is a Linux kernel reliability flaw in the ARM CoreSight TRBE driver. If buffer allocation fails, the driver can mishandle the failure and continue until the kernel panics. The documented impact is availability loss, not data theft or code execution.

Executive priority

Treat as a targeted availability risk for affected ARM Linux environments. It is not currently supported as actively exploited, but kernel panics can disrupt production workloads, so patch through normal kernel maintenance with priority for exposed ARM systems.

Technical view

arm_trbe_alloc_buffer() returned -ENOMEM on allocation failure, but etm_setup_aux() checked only for NULL. That mismatch let an allocation failure propagate as an unexpected pointer state, leading to kernel panic. Stable kernel commits change the failure return to NULL so callers handle it correctly.

Likely exposure

Exposure appears limited to Linux systems using the ARM CoreSight TRBE tracing path. The provided affected data lists Linux kernel versions and stable fixes, but distribution-specific package status is not included. Systems without this driver or tracing path are not shown as affected by the sources.

Exploitation context

The bundle does not cite active exploitation, public exploit code, or CISA KEV listing. The condition requires a TRBE allocation failure path; the sources support denial of service through kernel panic, not privilege escalation or remote compromise.

Researcher notes

The evidence is concise: a caller/callee error-handling contract mismatch in the TRBE allocation path. The CVE record lacks CVSS, CWE, exploit status, and distribution mapping, so validation should rely on kernel commit presence and vendor package advisories.

Mitigation direction

  • Apply vendor or distribution kernel updates containing the referenced stable fixes.
  • Prioritize ARM Linux systems where CoreSight TRBE tracing is enabled or available.
  • Check distribution advisories for exact package versions and backported fixes.
  • If patching is delayed, assess whether TRBE tracing can be disabled safely.

Validation and detection

  • Inventory Linux kernel versions on ARM systems using CoreSight TRBE.
  • Compare running kernels against vendor advisories and the referenced stable commits.
  • Confirm updated kernels include the NULL return handling change.
  • Review crash logs for kernel panics involving TRBE or etm_setup_aux.
Prepared
Confidence
medium
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-40060 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
7Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux3fbf7f011f2426dac8c982f1d2ef469a7959a524, 3fbf7f011f2426dac8c982f1d2ef469a7959a524, 3fbf7f011f2426dac8c982f1d2ef469a7959a524, 3fbf7f011f2426dac8c982f1d2ef469a7959a524, 3fbf7f011f2426dac8c982f1d2ef469a7959a524, 3fbf7f011f2426dac8c982f1d2ef469a7959a524unaffected
LinuxLinux5.13, 0, 5.15.195, 6.1.156, 6.6.112, 6.12.53, 6.17.3, 6.18affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.