CVE-2025-37923

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> tracing: Fix oob write in trace_seq_to_buffer()<br /> <br /> syzbot reported this bug:<br /> ==================================================================<br /> BUG: KASAN: slab-out-of-bounds in trace_seq_to_buffer kernel/trace/trace.c:1830 [inline]<br /> BUG: KASAN: slab-out-of-bounds in tracing_splice_read_pipe+0x6be/0xdd0 kernel/trace/trace.c:6822<br /> Write of size 4507 at addr ffff888032b6b000 by task syz.2.320/7260<br /> <br /> CPU: 1 UID: 0 PID: 7260 Comm: syz.2.320 Not tainted 6.15.0-rc1-syzkaller-00301-g3bde70a2c827 #0 PREEMPT(full)<br /> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025<br /> Call Trace:<br /> <br /> __dump_stack lib/dump_stack.c:94 [inline]<br /> dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120<br /> print_address_description mm/kasan/report.c:408 [inline]<br /> print_report+0xc3/0x670 mm/kasan/report.c:521<br /> kasan_report+0xe0/0x110 mm/kasan/report.c:634<br /> check_region_inline mm/kasan/generic.c:183 [inline]<br /> kasan_check_range+0xef/0x1a0 mm/kasan/generic.c:189<br /> __asan_memcpy+0x3c/0x60 mm/kasan/shadow.c:106<br /> trace_seq_to_buffer kernel/trace/trace.c:1830 [inline]<br /> tracing_splice_read_pipe+0x6be/0xdd0 kernel/trace/trace.c:6822<br /> ....<br /> ==================================================================<br /> <br /> It has been reported that trace_seq_to_buffer() tries to copy more data<br /> than PAGE_SIZE to buf. Therefore, to prevent this, we should use the<br /> smaller of trace_seq_used(&amp;iter-&gt;seq) and PAGE_SIZE as an argument.