🛡️ CVE-2025-21777 — kernel

ring-buffer: Validate the persistent meta data subbuf array

In the Linux kernel, the following vulnerability has been resolved:

ring-buffer: Validate the persistent meta data subbuf array

The meta data for a mapped ring buffer contains an array of indexes of all

the subbuffers. The first entry is the reader page, and the rest of the

entries lay out the order of the subbuffers in how the ring buffer link

list is to be created.

The validator currently makes sure that all the entries are within the

range of 0 and nr_subbufs. But it does not check if there are any

duplicates.

While working on the ring buffer, I corrupted this array, where I added

duplicates. The validator did not catch it and created the ring buffer

link list on top of it. Luckily, the corruption was only that the reader

page was also in the writer path and only presented corrupted data but did

not crash the kernel. But if there were duplicates in the writer side,

then it could corrupt the ring buffer link list and cause a crash.

Create a bitmask array with the size of the number of subbuffers. Then

clear it. When walking through the subbuf array checking to see if the

entries are within the range, test if its bit is already set in the

subbuf_mask. If it is, then there is duplicates and fail the validation.

If not, set the corresponding bit and continue.