CVE-2025-21777

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ring-buffer: Validate the persistent meta data subbuf array

The meta data for a mapped ring buffer contains an array of indexes of all

the subbuffers. The first entry is the reader page, and the rest of the

entries lay out the order of the subbuffers in how the ring buffer link

list is to be created.

The validator currently makes sure that all the entries are within the

range of 0 and nr_subbufs. But it does not check if there are any

duplicates.

While working on the ring buffer, I corrupted this array, where I added

duplicates. The validator did not catch it and created the ring buffer

link list on top of it. Luckily, the corruption was only that the reader

page was also in the writer path and only presented corrupted data but did

not crash the kernel. But if there were duplicates in the writer side,

then it could corrupt the ring buffer link list and cause a crash.

Create a bitmask array with the size of the num

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References