In the Linux kernel, the following vulnerability has been resolved:
tracing: Fix oob write in traceseqto_buffer()
BUG: KASAN: slab-out-of-bounds in traceseqtobuffer kernel/trace/trace.c:1830 [inline] BUG: KASAN: slab-out-of-bounds in tracingsplicereadpipe+0x6be/0xdd0 kernel/trace/trace.c:6822 Write of size 4507 at addr ffff888032b6b000 by task syz.2.320/7260
CPU: 1 UID: 0 PID: 7260 Comm: syz.2.320 Not tainted 6.15.0-rc1-syzkaller-00301-g3bde70a2c827 #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 Call Trace: <TASK> _dumpstack lib/dumpstack.c:94 [inline] dumpstacklvl+0x116/0x1f0 lib/dumpstack.c:120 printaddressdescription mm/kasan/report.c:408 [inline] printreport+0xc3/0x670 mm/kasan/report.c:521 kasanreport+0xe0/0x110 mm/kasan/report.c:634 checkregioninline mm/kasan/generic.c:183 [inline] kasancheckrange+0xef/0x1a0 mm/kasan/generic.c:189 _asanmemcpy+0x3c/0x60 mm/kasan/shadow.c:106 traceseqtobuffer kernel/trace/trace.c:1830 [inline] tracingsplicereadpipe+0x6be/0xdd0 kernel/trace/trace.c:6822
It has been reported that traceseqtobuffer() tries to copy more data than PAGESIZE to buf. Therefore, to prevent this, we should use the smaller of traceseqused(&iter->seq) and PAGE_SIZE as an argument.
[
{
"digest": {
"line_hashes": [
"238515890335846101772680892947008517766",
"124148385269055966650304178730057731726",
"241174158430838613548578375659339072960",
"134945885350757053004382678250418719347",
"299680126336792199709537419236028301117",
"120177295615523603154203513527505830669",
"16500203095089309337365656314040919823",
"27864710295968986256437162561604374484",
"288150067624394029223870044349769052164",
"288200037059528269838538732963623082604"
],
"threshold": 0.9
},
"target": {
"file": "kernel/trace/trace.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@056ebbddb8faf4ddf83d005454dd78fc25c2d897",
"deprecated": false,
"id": "CVE-2025-37923-12ec1229",
"signature_type": "Line"
},
{
"digest": {
"line_hashes": [
"238515890335846101772680892947008517766",
"124148385269055966650304178730057731726",
"241174158430838613548578375659339072960",
"134945885350757053004382678250418719347",
"299680126336792199709537419236028301117",
"120177295615523603154203513527505830669",
"16500203095089309337365656314040919823",
"27864710295968986256437162561604374484",
"288150067624394029223870044349769052164",
"288200037059528269838538732963623082604"
],
"threshold": 0.9
},
"target": {
"file": "kernel/trace/trace.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@665ce421041890571852422487f4c613d1824ba9",
"deprecated": false,
"id": "CVE-2025-37923-13a060ce",
"signature_type": "Line"
},
{
"digest": {
"length": 1585.0,
"function_hash": "9556207785000490126236479744664483346"
},
"target": {
"function": "tracing_splice_read_pipe",
"file": "kernel/trace/trace.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c5d2b66c5ef5037b4b4360e5447605ff00ba1bd4",
"deprecated": false,
"id": "CVE-2025-37923-2412f5ed",
"signature_type": "Function"
},
{
"digest": {
"length": 1585.0,
"function_hash": "9556207785000490126236479744664483346"
},
"target": {
"function": "tracing_splice_read_pipe",
"file": "kernel/trace/trace.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@665ce421041890571852422487f4c613d1824ba9",
"deprecated": false,
"id": "CVE-2025-37923-2db6a22b",
"signature_type": "Function"
},
{
"digest": {
"length": 1585.0,
"function_hash": "288808082174069643629095513396416524532"
},
"target": {
"function": "tracing_splice_read_pipe",
"file": "kernel/trace/trace.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f4b0174e9f18aaba59ee6ffdaf8827a7f94eb606",
"deprecated": false,
"id": "CVE-2025-37923-382039ff",
"signature_type": "Function"
},
{
"digest": {
"length": 1585.0,
"function_hash": "9556207785000490126236479744664483346"
},
"target": {
"function": "tracing_splice_read_pipe",
"file": "kernel/trace/trace.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1a3f9482b50b74fa9421bff8ceecfefd0dc06f8f",
"deprecated": false,
"id": "CVE-2025-37923-4137b650",
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"238515890335846101772680892947008517766",
"124148385269055966650304178730057731726",
"241174158430838613548578375659339072960",
"134945885350757053004382678250418719347",
"299680126336792199709537419236028301117",
"120177295615523603154203513527505830669",
"16500203095089309337365656314040919823",
"27864710295968986256437162561604374484",
"288150067624394029223870044349769052164",
"288200037059528269838538732963623082604"
],
"threshold": 0.9
},
"target": {
"file": "kernel/trace/trace.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c5d2b66c5ef5037b4b4360e5447605ff00ba1bd4",
"deprecated": false,
"id": "CVE-2025-37923-6467d05f",
"signature_type": "Line"
},
{
"digest": {
"length": 1585.0,
"function_hash": "9556207785000490126236479744664483346"
},
"target": {
"function": "tracing_splice_read_pipe",
"file": "kernel/trace/trace.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@441021e5b3c7d9bd1b963590652c415929f3b157",
"deprecated": false,
"id": "CVE-2025-37923-8876388f",
"signature_type": "Function"
},
{
"digest": {
"length": 1585.0,
"function_hash": "9556207785000490126236479744664483346"
},
"target": {
"function": "tracing_splice_read_pipe",
"file": "kernel/trace/trace.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@056ebbddb8faf4ddf83d005454dd78fc25c2d897",
"deprecated": false,
"id": "CVE-2025-37923-8e067c05",
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"238515890335846101772680892947008517766",
"124148385269055966650304178730057731726",
"241174158430838613548578375659339072960",
"134945885350757053004382678250418719347",
"299680126336792199709537419236028301117",
"120177295615523603154203513527505830669",
"16500203095089309337365656314040919823",
"27864710295968986256437162561604374484",
"288150067624394029223870044349769052164",
"288200037059528269838538732963623082604"
],
"threshold": 0.9
},
"target": {
"file": "kernel/trace/trace.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1a3f9482b50b74fa9421bff8ceecfefd0dc06f8f",
"deprecated": false,
"id": "CVE-2025-37923-8e4f2c43",
"signature_type": "Line"
},
{
"digest": {
"line_hashes": [
"238515890335846101772680892947008517766",
"124148385269055966650304178730057731726",
"241174158430838613548578375659339072960",
"134945885350757053004382678250418719347",
"299680126336792199709537419236028301117",
"120177295615523603154203513527505830669",
"16500203095089309337365656314040919823",
"27864710295968986256437162561604374484",
"288150067624394029223870044349769052164",
"288200037059528269838538732963623082604"
],
"threshold": 0.9
},
"target": {
"file": "kernel/trace/trace.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f5178c41bb43444a6008150fe6094497135d07cb",
"deprecated": false,
"id": "CVE-2025-37923-a29db4a1",
"signature_type": "Line"
},
{
"digest": {
"length": 1585.0,
"function_hash": "9556207785000490126236479744664483346"
},
"target": {
"function": "tracing_splice_read_pipe",
"file": "kernel/trace/trace.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f5178c41bb43444a6008150fe6094497135d07cb",
"deprecated": false,
"id": "CVE-2025-37923-b57e5cfd",
"signature_type": "Function"
},
{
"digest": {
"length": 1585.0,
"function_hash": "9556207785000490126236479744664483346"
},
"target": {
"function": "tracing_splice_read_pipe",
"file": "kernel/trace/trace.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1f27a3e93b8d674b24b27fcdbc6f72743cd96c0d",
"deprecated": false,
"id": "CVE-2025-37923-b7cc4484",
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"238515890335846101772680892947008517766",
"124148385269055966650304178730057731726",
"241174158430838613548578375659339072960",
"134945885350757053004382678250418719347",
"299680126336792199709537419236028301117",
"120177295615523603154203513527505830669",
"16500203095089309337365656314040919823",
"27864710295968986256437162561604374484",
"288150067624394029223870044349769052164",
"288200037059528269838538732963623082604"
],
"threshold": 0.9
},
"target": {
"file": "kernel/trace/trace.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@441021e5b3c7d9bd1b963590652c415929f3b157",
"deprecated": false,
"id": "CVE-2025-37923-da3ac799",
"signature_type": "Line"
},
{
"digest": {
"line_hashes": [
"238515890335846101772680892947008517766",
"124148385269055966650304178730057731726",
"241174158430838613548578375659339072960",
"134945885350757053004382678250418719347",
"299680126336792199709537419236028301117",
"120177295615523603154203513527505830669",
"16500203095089309337365656314040919823",
"27864710295968986256437162561604374484",
"288150067624394029223870044349769052164",
"288200037059528269838538732963623082604"
],
"threshold": 0.9
},
"target": {
"file": "kernel/trace/trace.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1f27a3e93b8d674b24b27fcdbc6f72743cd96c0d",
"deprecated": false,
"id": "CVE-2025-37923-dbdf16a7",
"signature_type": "Line"
},
{
"digest": {
"line_hashes": [
"238515890335846101772680892947008517766",
"124148385269055966650304178730057731726",
"241174158430838613548578375659339072960",
"134945885350757053004382678250418719347",
"299680126336792199709537419236028301117",
"120177295615523603154203513527505830669",
"16500203095089309337365656314040919823",
"27864710295968986256437162561604374484",
"288150067624394029223870044349769052164",
"288200037059528269838538732963623082604"
],
"threshold": 0.9
},
"target": {
"file": "kernel/trace/trace.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f4b0174e9f18aaba59ee6ffdaf8827a7f94eb606",
"deprecated": false,
"id": "CVE-2025-37923-edea8fad",
"signature_type": "Line"
}
]