CVE-2025-38267

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ring-buffer: Do not trigger WARN_ON() due to a commit_overrun

When reading a memory mapped buffer the reader page is just swapped out

with the last page written in the write buffer. If the reader page is the

same as the commit buffer (the buffer that is currently being written to)

it was assumed that it should never have missed events. If it does, it

triggers a WARN_ON_ONCE().

But there just happens to be one scenario where this can legitimately

happen. That is on a commit_overrun. A commit overrun is when an interrupt

preempts an event being written to the buffer and then the interrupt adds

so many new events that it fills and wraps the buffer back to the commit.

Any new events would then be dropped and be reported as "missed_events".

In this case, the next page to read is the commit buffer and after the

swap of the reader page, the reader page will be the commit buffer, but

this time there will be missed events a

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References