{"id":"DEBIAN-CVE-2025-38267","details":"In the Linux kernel, the following vulnerability has been resolved:  ring-buffer: Do not trigger WARN_ON() due to a commit_overrun  When reading a memory mapped buffer the reader page is just swapped out with the last page written in the write buffer. If the reader page is the same as the commit buffer (the buffer that is currently being written to) it was assumed that it should never have missed events. If it does, it triggers a WARN_ON_ONCE().  But there just happens to be one scenario where this can legitimately happen. That is on a commit_overrun. A commit overrun is when an interrupt preempts an event being written to the buffer and then the interrupt adds so many new events that it fills and wraps the buffer back to the commit. Any new events would then be dropped and be reported as \"missed_events\".  In this case, the next page to read is the commit buffer and after the swap of the reader page, the reader page will be the commit buffer, but this time there will be missed events and this triggers the following warning:   ------------[ cut here ]------------  WARNING: CPU: 2 PID: 1127 at kernel/trace/ring_buffer.c:7357 ring_buffer_map_get_reader+0x49a/0x780  Modules linked in: kvm_intel kvm irqbypass  CPU: 2 UID: 0 PID: 1127 Comm: trace-cmd Not tainted 6.15.0-rc7-test-00004-g478bc2824b45-dirty #564 PREEMPT  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014  RIP: 0010:ring_buffer_map_get_reader+0x49a/0x780  Code: 00 00 00 48 89 fe 48 c1 ee 03 80 3c 2e 00 0f 85 ec 01 00 00 4d 3b a6 a8 00 00 00 0f 85 8a fd ff ff 48 85 c0 0f 84 55 fe ff ff \u003c0f\u003e 0b e9 4e fe ff ff be 08 00 00 00 4c 89 54 24 58 48 89 54 24 50  RSP: 0018:ffff888121787dc0 EFLAGS: 00010002  RAX: 00000000000006a2 RBX: ffff888100062800 RCX: ffffffff8190cb49  RDX: ffff888126934c00 RSI: 1ffff11020200a15 RDI: ffff8881010050a8  RBP: dffffc0000000000 R08: 0000000000000000 R09: ffffed1024d26982  R10: ffff888126934c17 R11: ffff8881010050a8 R12: ffff888126934c00  R13: ffff8881010050b8 R14: ffff888101005000 R15: ffff888126930008  FS:  00007f95c8cd7540(0000) GS:ffff8882b576e000(0000) knlGS:0000000000000000  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033  CR2: 00007f95c8de4dc0 CR3: 0000000128452002 CR4: 0000000000172ef0  Call Trace:   \u003cTASK\u003e   ? __pfx_ring_buffer_map_get_reader+0x10/0x10   tracing_buffers_ioctl+0x283/0x370   __x64_sys_ioctl+0x134/0x190   do_syscall_64+0x79/0x1c0   entry_SYSCALL_64_after_hwframe+0x76/0x7e  RIP: 0033:0x7f95c8de48db  Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 \u003c89\u003e c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00  RSP: 002b:00007ffe037ba110 EFLAGS: 00000246 ORIG_RAX: 0000000000000010  RAX: ffffffffffffffda RBX: 00007ffe037bb2b0 RCX: 00007f95c8de48db  RDX: 0000000000000000 RSI: 0000000000005220 RDI: 0000000000000006  RBP: 00007ffe037ba180 R08: 0000000000000000 R09: 0000000000000000  R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000  R13: 00007ffe037bb6f8 R14: 00007f95c9065000 R15: 00005575c7492c90   \u003c/TASK\u003e  irq event stamp: 5080  hardirqs last  enabled at (5079): [\u003cffffffff83e0adb0\u003e] _raw_spin_unlock_irqrestore+0x50/0x70  hardirqs last disabled at (5080): [\u003cffffffff83e0aa83\u003e] _raw_spin_lock_irqsave+0x63/0x70  softirqs last  enabled at (4182): [\u003cffffffff81516122\u003e] handle_softirqs+0x552/0x710  softirqs last disabled at (4159): [\u003cffffffff815163f7\u003e] __irq_exit_rcu+0x107/0x210  ---[ end trace 0000000000000000 ]---  The above was triggered by running on a kernel with both lockdep and KASAN as well as kmemleak enabled and executing the following command:   # perf record -o perf-test.dat -a -- trace-cmd record --nosplice  -e all -p function hackbench 50  With perf interjecting a lot of interrupts and trace-cmd enabling all events as well as function tracing, with lockdep, KASAN and kmemleak enabled, it could cause an interrupt preempting an event being written to add enough event ---truncated---","modified":"2026-08-27T23:05:21.581041227Z","published":"2025-07-10T08:15:24.833Z","upstream":["CVE-2025-38267"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2025-38267"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.35-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-38267.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.35-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-38267.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}