CVE-2025-68376

What it actually does

Use-after-free occurs in coresight ETR when operating in CS_MODE_SYSFS: changing buffer size allocates new memory (buf_new), updates sysfs_buf to it, and frees the prior buffer (buf_old), yet the active etr_buf pointer remains referencing the freed buf_old.

Why it matters to the business

Systems using affected Linux kernels or Chainguard kuma packages may experience kernel instability, crashes, or potential code execution when coresight ETR tracing is reconfigured via sysfs, increasing operational risk for embedded, automotive, or debug-enabled deployments.

How an attack unfolds

An attacker with access to the coresight sysfs interface enables ETR in CS_MODE_SYSFS, alters the buffer size to trigger allocation of a new buffer, then continues using the now-freed original buffer through the stale etr_buf reference, leading to memory corruption.

How to fix it

Update to fixed kernel commit 70acbc9c77686b7a521af6d7a543dcd9c324cf07 or later; for Chainguard packages upgrade kuma-2.6, kuma-cni-2.6, kuma-cp-2.6, kuma-dp-2.6 and related components to version 2.6.15-r4 or newer.

How to confirm the fix worked

Verify the running kernel contains commit 70acbc9c77686b7a521af6d7a543dcd9c324cf07; confirm Chainguard package versions are at or above 2.6.15-r4; test sysfs buffer resize operations under CS_MODE_SYSFS to ensure no use-after-free occurs.

Typical attack path

1. Obtain local access or sufficient privileges to interact with /sys/bus/coresight/devices
2. Enable ETR tracing in CS_MODE_SYSFS mode
3. Modify the buffer size attribute to force reallocation
4. Trigger continued ETR activity that dereferences the stale buffer pointer
5. Exploit resulting use-after-free for denial of service or privilege escalation

How to detect it

Review kernel logs for coresight ETR related oops, slab-use-after-free warnings, or KASAN reports triggered after sysfs buffer resize operations; examine audit logs for unusual writes to coresight device attributes.

What your security team should do

• Prioritize patching kernels and Chainguard kuma packages within maintenance windows given the 306-day publication age
• Restrict untrusted access to coresight sysfs interfaces on systems where ETR tracing is enabled
• Monitor for kernel oops or panic events related to coresight ETR buffer handling