PT-2025-8890 · Linux+1 · Linux Kernel+1

Published 2025-02-15 · Updated 2025-02-28 · CVE-2025-21778

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to the fixed version

Description A vulnerability in the Linux kernel has been resolved. The issue occurs when trying to mmap a trace instance buffer that is attached to reserve mem, causing a crash. The reason for the crash is that the code that maps the ring buffer pages to user space uses virt to page(), which does not work with vmap()'d memory. As a result, mmap() of instances that have their ring buffer from the reserve mem option is disabled, and attempting to perform an mmap() on a persistent buffer will return -ENODEV.

Recommendations For Linux kernel versions prior to the fixed version, consider disabling the mmap() of trace instance buffers that are attached to reserve mem as a temporary workaround until a patch is available.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2025-11819

CVE-2025-21778

Affected Products

Astra Linux

Linux Kernel

References · 22

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/21xxx/CVE-2025-21778.json · Exploit
• https://git.kernel.org/stable/c/e8dff5f73912513fc9b52ab992d861517c9a9975 · Patch
• https://osv.dev/vulnerability/BELL-CVE-2025-21778 · Vendor Advisory
• https://git.kernel.org/stable/c/cf5aa560e5c7628b57c928741d7e6a9a0f6f0e67 · Patch
• https://linux.oracle.com/errata/ELSA-2025-20480.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-21778 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-21778 · Vendor Advisory
• https://git.kernel.org/stable/c/129fe718819cc5e24ea2f489db9ccd4371f0c6f6 · Patch
• https://osv.dev/vulnerability/CVE-2025-21778 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2025-20530.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-11819 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-21778 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-21778 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-21778 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2025-0811SE18 · Vendor Advisory