Executive brief
A vulnerability in the Linux kernel's CoreSight hardware tracing subsystem can cause a system crash (kernel oops). CoreSight is used by developers and system administrators to monitor processor activity for debugging and performance analysis. An attacker with local access could exploit this flaw to disrupt system operations or potentially gain unauthorized access to sensitive kernel memory.
Technical details
A vulnerability in the Linux kernel CoreSight subsystem arises from the TMC (Trace Memory Controller) ETR (Embedded Trace Router) failing to properly pass the event handle through the coresight_path. In 'perf' mode, the handle is required to retrieve AUX_EVENT data for each CPU; without it, dependent components like CATU (Command Address Translation Unit) attempt to access invalid memory addresses. This results in a kernel paging request error (oops) in tmc_etr_get_buffer. The issue was introduced by changes that modified functions to accept coresight_path without ensuring the handle was included. Patches have been released for various stable branches including 6.17.13 and 6.18.2.
Affected products
- Linux Linux 6.15 to 6.17.12, 6.18.1
Timeline
- 2025-12-24: disclosed
- 2025-12-24: advisory
- 2025-11-10: patched