Security readout for executives and security teams
Plain-English summary
A local user may trigger a Linux kernel crash through CoreSight performance tracing because required event information is missing from a device path. The supplied CVSS score is 7.8 (high), but the public description demonstrates a kernel oops rather than confirmed data theft or system takeover.
Executive priority
Prioritize systems where untrusted local users can access performance tracing, especially shared or sensitive hosts. Treat patching as high priority because a kernel crash is demonstrated, while avoiding claims of active exploitation or proven takeover. Lower priority may be appropriate after confirming that CoreSight components or tracing access are absent.
Technical view
In CoreSight perf mode, dependent TMC/CATU devices require the event handle to retrieve each CPU’s AUX_EVENT. The affected path omitted that handle, allowing invalid memory access during trace-buffer setup. The kernel fix adds the handle to coresight_path. The supplied version data identifies several affected releases but does not clearly map each stable fix to every release.
Likely exposure
Exposure is primarily Linux systems using CoreSight tracing with perf and dependent TMC/CATU devices. The CVSS vector requires local access and low privileges, with no user interaction. Systems without the relevant hardware, drivers, or tracing access are less likely to be exposed. Confirm distribution-specific applicability because the supplied version list is ambiguous.
Exploitation context
CISA KEV status is false, and the supplied sources provide no evidence of active exploitation. A reproducible kernel oops is documented. Although the CVSS vector assigns high confidentiality, integrity, and availability impacts, the description itself only demonstrates invalid memory access and a crash; broader security impact is not established here.
Researcher notes
The record supplies no CWE and no confirmed exploit activity. The failure occurs while enabling a CoreSight path, with tmc_etr_get_buffer and catu_enable_hw in the trace. Three stable commits are referenced, but the bundle does not identify their exact release mappings. Assess vendor backports rather than relying only on upstream version numbers.
Mitigation direction
- Upgrade to a vendor kernel containing the applicable referenced stable fix.
- Check distribution security guidance for corrected package and release mappings.
- Restrict untrusted access to performance tracing until remediation is confirmed.
- Avoid enabling unnecessary CoreSight tracing on exposed multi-user systems.
Validation and detection
- Record the running kernel version and compare it with vendor advisories.
- Verify the applicable stable fix is present in the deployed kernel source or package.
- Confirm whether CoreSight TMC or CATU components are enabled and used.
- Review kernel logs for paging requests involving TMC, CATU, or CoreSight paths.
- Perform any reproduction only in an isolated, disposable test environment.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-68370 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/faa8f38f7ccb344ace2c1f364efc70e3a12d32f3CVE reference, Linux
- https://git.kernel.org/stable/c/d0c9effd82f2c19b92acd07d357fac5f392d549aCVE reference, Linux
- https://git.kernel.org/stable/c/aaa5abcc9d44d2c8484f779ab46d242d774cabcbCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.