CVE-2025-21778 in Linux
Summary
by MITRE • 02/27/2025
In the Linux kernel, the following vulnerability has been resolved:
tracing: Do not allow mmap() of persistent ring buffer
When trying to mmap a trace instance buffer that is attached to reserve_mem, it would crash:
BUG: unable to handle page fault for address: ffffe97bd00025c8 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 2862f3067 P4D 2862f3067 PUD 0 Oops: Oops: 0000 [#1] PREEMPT_RT SMP PTI
CPU: 4 UID: 0 PID: 981 Comm: mmap-rb Not tainted 6.14.0-rc2-test-00003-g7f1a5e3fbf9e-dirty #233 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:validate_page_before_insert+0x5/0xb0 Code: e2 01 89 d0 c3 cc cc cc cc 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 <48> 8b 46 08 a8 01 75 67 66 90 48 89 f0 8b 50 34 85 d2 74 76 48 89 RSP: 0018:ffffb148c2f3f968 EFLAGS: 00010246 RAX: ffff9fa5d3322000 RBX: ffff9fa5ccff9c08 RCX: 00000000b879ed29 RDX: ffffe97bd00025c0 RSI: ffffe97bd00025c0 RDI: ffff9fa5ccff9c08 RBP: ffffb148c2f3f9f0 R08: 0000000000000004 R09: 0000000000000004 R10: 0000000000000000 R11: 0000000000000200 R12: 0000000000000000 R13: 00007f16a18d5000 R14: ffff9fa5c48db6a8 R15: 0000000000000000 FS: 00007f16a1b54740(0000) GS:ffff9fa73df00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffe97bd00025c8 CR3: 00000001048c6006 CR4: 0000000000172ef0 Call Trace: <TASK> ? __die_body.cold+0x19/0x1f ? __die+0x2e/0x40 ? page_fault_oops+0x157/0x2b0 ? search_module_extables+0x53/0x80 ? validate_page_before_insert+0x5/0xb0 ? kernelmode_fixup_or_oops.isra.0+0x5f/0x70 ? __bad_area_nosemaphore+0x16e/0x1b0 ? bad_area_nosemaphore+0x16/0x20 ? do_kern_addr_fault+0x77/0x90 ? exc_page_fault+0x22b/0x230 ? asm_exc_page_fault+0x2b/0x30 ? validate_page_before_insert+0x5/0xb0 ? vm_insert_pages+0x151/0x400 __rb_map_vma+0x21f/0x3f0 ring_buffer_map+0x21b/0x2f0 tracing_buffers_mmap+0x70/0xd0 __mmap_region+0x6f0/0xbd0 mmap_region+0x7f/0x130 do_mmap+0x475/0x610 vm_mmap_pgoff+0xf2/0x1d0 ksys_mmap_pgoff+0x166/0x200 __x64_sys_mmap+0x37/0x50 x64_sys_call+0x1670/0x1d70 do_syscall_64+0xbb/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f
The reason was that the code that maps the ring buffer pages to user space has:
page = virt_to_page((void *)cpu_buffer->subbuf_ids[s]);
And uses that in:
vm_insert_pages(vma, vma->vm_start, pages, &nr_pages);
But virt_to_page() does not work with vmap()'d memory which is what the persistent ring buffer has. It is rather trivial to allow this, but for now just disable mmap() of instances that have their ring buffer from the reserve_mem option.
If an mmap() is performed on a persistent buffer it will return -ENODEV just like it would if the .mmap field wasn't defined in the file_operations structure.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 05/25/2026
The vulnerability described in CVE-2025-21778 resides within the Linux kernel's tracing subsystem, specifically concerning the management of persistent ring buffers used for kernel tracing operations. This issue manifests when attempting to map a trace instance buffer that is attached to reserve_mem through the mmap() system call, resulting in a kernel page fault and subsequent system crash. The flaw occurs because the kernel's ring buffer mapping code attempts to convert virtual addresses to page structures using virt_to_page() function, which is incompatible with vmap'd memory - a memory mapping technique used by persistent ring buffers. This incompatibility creates a critical condition where the kernel cannot properly handle memory mapping operations for these specific buffer instances, leading to potential system instability and denial of service. The vulnerability directly impacts the kernel's memory management subsystem and can be classified under CWE-125: Out-of-bounds Read, as the system attempts to access memory that is not properly mapped or accessible.
The technical root cause lies in the improper handling of memory mapping for persistent ring buffers within the kernel's tracing infrastructure. When a process attempts to mmap a trace instance buffer that utilizes reserve_mem for its ring buffer allocation, the code path triggers a page fault due to incorrect memory address translation. The function validate_page_before_insert() fails when processing pages obtained through virt_to_page() from vmap'd memory regions, which are not compatible with the standard page mapping functions. This misconfiguration stems from the kernel's failure to distinguish between different memory mapping types when preparing pages for user-space mapping. The system crash occurs during the vm_insert_pages() operation, where the kernel attempts to insert pages into a virtual memory area but encounters memory that cannot be properly translated due to the vmap memory type. This vulnerability demonstrates a critical flaw in kernel memory management and buffer handling, particularly in scenarios involving persistent kernel tracing mechanisms.
The operational impact of this vulnerability extends beyond simple system crashes to potentially compromise system stability and availability in environments where kernel tracing is actively utilized. Attackers could exploit this weakness by crafting malicious mmap() operations against trace instance buffers, leading to denial of service conditions that could disrupt critical system operations. The vulnerability affects systems running Linux kernel versions that include the tracing subsystem with persistent ring buffer functionality, particularly those utilizing reserve_mem for buffer allocation. The crash manifests as a kernel oops condition with specific error codes indicating page fault conditions in kernel mode, making it difficult to recover without system reboot. This vulnerability impacts the reliability of kernel tracing infrastructure and could be leveraged in escalation attacks where an attacker seeks to destabilize system operations or gain unauthorized access through system instability.
The recommended mitigations for this vulnerability involve disabling mmap() operations on trace instance buffers that utilize persistent ring buffers allocated through reserve_mem. This approach aligns with the principle of least privilege and prevents the exploitation of memory mapping inconsistencies. System administrators should ensure that kernel tracing configurations avoid using reserve_mem for ring buffer allocation when mmap() functionality is required, or alternatively, implement proper access controls to limit mmap() operations on sensitive trace instances. The kernel fix implemented addresses this by returning -ENODEV error code when attempting to mmap persistent buffers, effectively preventing the problematic memory mapping operations. Organizations should also monitor their kernel tracing configurations and ensure that persistent buffer usage is carefully evaluated against the need for mmap() functionality. This vulnerability highlights the importance of proper memory management in kernel subsystems and the need for comprehensive testing of memory mapping operations in complex kernel features. The solution follows established security practices by preventing access to potentially problematic memory regions rather than attempting to fix the underlying mapping issue, which could introduce additional vulnerabilities.