CVE-2025-37923 Overview
CVE-2025-37923 is an out-of-bounds write vulnerability in the Linux kernel's tracing subsystem. The flaw resides in the trace_seq_to_buffer() function within kernel/trace/trace.c. When tracing_splice_read_pipe() invokes this function, it can copy more data than PAGE_SIZE bytes into the destination buffer. The bug was reported by syzbot through KASAN instrumentation, which detected a slab-out-of-bounds write of 4507 bytes. The vulnerability affects multiple Linux kernel versions, including 6.15-rc1 through 6.15-rc4, and is also tracked in Debian 11. The issue is classified under [CWE-787] Out-of-Bounds Write.
Critical Impact
A local, low-privileged user interacting with the tracing subsystem can trigger a kernel heap out-of-bounds write, potentially leading to memory corruption, denial of service, or local privilege escalation.
Affected Products
- Linux Kernel 6.15-rc1, rc2, rc3, and rc4
- Linux Kernel stable branches prior to the fixed commits
- Debian Linux 11 (patched via Debian LTS)
Discovery Timeline
- 2025-05-20 - CVE-2025-37923 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2025-37923
Vulnerability Analysis
The vulnerability exists in the Linux kernel tracing infrastructure, specifically in trace_seq_to_buffer() at kernel/trace/trace.c:1830. The function is called from tracing_splice_read_pipe() at line 6822 when userspace consumes trace data through the splice interface.
The root cause is a missing bounds check. trace_seq_to_buffer() passes trace_seq_used(&iter->seq) as the copy length without comparing it against the destination buffer size. When the accumulated trace sequence data exceeds PAGE_SIZE, the resulting memcpy writes past the end of the page-sized destination buffer.
Syzbot reproduced the issue and KASAN reported a write of 4507 bytes into a slab object, exceeding the allocated region. The fix constrains the copy length to min(trace_seq_used(&iter->seq), PAGE_SIZE), ensuring the write stays within the target buffer.
Root Cause
The defect is an improper length calculation. The kernel trusted trace_seq_used() to reflect a value bounded by the destination page, but the sequence buffer can accumulate more than PAGE_SIZE bytes. Absent an explicit min() clamp, the memcpy() operation overruns the slab allocation, corrupting adjacent kernel memory ([CWE-787]).
Attack Vector
Exploitation requires local access with permission to open and read tracing interfaces such as /sys/kernel/tracing/trace_pipe. An attacker uses splice() against the trace pipe file descriptor to invoke tracing_splice_read_pipe(), causing the vulnerable copy. The attack is local, requires low privileges, and needs no user interaction. Successful exploitation corrupts kernel heap memory and may enable privilege escalation or system crash.
No public proof-of-concept beyond the syzbot reproducer has been released. See the Kernel Git Commit f5178c41bb for the upstream fix.
Detection Methods for CVE-2025-37923
Indicators of Compromise
- KASAN reports referencing slab-out-of-bounds in trace_seq_to_buffer or tracing_splice_read_pipe in dmesg or the kernel log.
- Unexpected kernel oops, panic, or general protection fault messages originating from kernel/trace/trace.c.
- Unprivileged processes issuing splice() system calls against files under /sys/kernel/tracing/ or /sys/kernel/debug/tracing/.
Detection Strategies
- Enable KASAN on test kernels to identify out-of-bounds writes originating from tracing paths.
- Monitor kernel logs for BUG: KASAN entries and correlate with the process name and PID that triggered the fault.
- Audit which local users and containers have read access to tracing filesystems, as this scope defines the attack surface.
Monitoring Recommendations
- Collect auditd events for open() and splice() operations targeting /sys/kernel/tracing/trace_pipe and related trace files.
- Alert on kernel messages containing KASAN, slab-out-of-bounds, or trace_seq_to_buffer.
- Track kernel package versions across the fleet to identify hosts still running vulnerable 6.15-rc builds or unpatched stable kernels.
How to Mitigate CVE-2025-37923
Immediate Actions Required
- Apply the upstream kernel patch or distribution update that clamps the copy length in trace_seq_to_buffer() to min(trace_seq_used(&iter->seq), PAGE_SIZE).
- Update Debian 11 hosts using the fixes referenced in the Debian LTS Announcement August 2025 and Debian LTS Announcement October 2025.
- Restrict access to tracing filesystems so that only privileged administrators can read trace_pipe.
Patch Information
The fix is available in multiple stable-tree commits, including Kernel Git Commit f5178c41bb, Kernel Git Commit 056ebbddb8, Kernel Git Commit 1a3f9482b5, Kernel Git Commit 1f27a3e93b, Kernel Git Commit 441021e5b3, Kernel Git Commit 665ce42104, Kernel Git Commit c5d2b66c5e, and Kernel Git Commit f4b0174e9f. Debian users should install the updated linux package from Debian LTS.
Workarounds
- Remount tracing filesystems to remove non-root read access: mount -o remount,mode=0700 /sys/kernel/tracing.
- Disable tracing on production systems that do not require it by unsetting CONFIG_TRACING in custom kernels or restricting tracefs mounts.
- Deny local unprivileged users and untrusted containers access to /sys/kernel/tracing and /sys/kernel/debug via SELinux, AppArmor, or namespace controls.
# Configuration example
# Restrict tracefs to root only
chmod 700 /sys/kernel/tracing
chmod 700 /sys/kernel/debug/tracing
# Verify running kernel version and rebuild status
uname -r
apt list --installed 2>/dev/null | grep linux-image
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
