Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2025-38424

perf: Fix sample vs do_exit()

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 5.4.295, 5.10.239, 5.15.186, 6.1.142, 6.6.95, and 2 more
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: no
  • Technical impact: total

Summary

In the Linux kernel, the following vulnerability has been resolved: perf: Fix sample vs do_exit() Baisheng Gao reported an ARM64 crash, which Mark decoded as being a synchronous external abort -- most likely due to trying to access MMIO in bad ways. The crash further shows perf trying to do a user stack sample while in exit_mmap()'s tlb_finish_mmu() -- i.e. while tearing down the address space it is trying to access. It turns out that we stop perf after we tear down the userspace mm; a receipie for disaster, since perf likes to access userspace for various reasons. Flip this order by moving up where we stop perf in do_exit(). Additionally, harden PERF_SAMPLE_CALLCHAIN and PERF_SAMPLE_STACK_USER to abort when the current task does not have an mm (exit_mm() makes sure to set current->mm = NULL; before commencing with the actual teardown). Such that CPU wide events don't trip on this same problem.

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: no · Technical impact: total

  3. Record last updated

Affected versions

  • Linux Linux

    From c5ebcedb566ef17bda7b02686e0d658a7bb42ee7 · fixed in 7b8f3c72175c6a63a95cf2e219f8b78e2baad34e; From c5ebcedb566ef17bda7b02686e0d658a7bb42ee7 · fixed in 507c9a595bad3abd107c6a8857d7fd125d89f386; From c5ebcedb566ef17bda7b02686e0d658a7bb42ee7 · fixed in a9f6aab7910a0ef2895797f15c947f6d1053160f; From c5ebcedb566ef17bda7b02686e0d658a7bb42ee7 · fixed in 975ffddfa2e19823c719459d2364fcaa17673964; From c5ebcedb566ef17bda7b02686e0d658a7bb42ee7 · fixed in 2ee6044a693735396bb47eeaba1ac3ae26c1c99b; From c5ebcedb566ef17bda7b02686e0d658a7bb42ee7 · fixed in 456019adaa2f5366b89c868dea9b483179bece54; From c5ebcedb566ef17bda7b02686e0d658a7bb42ee7 · fixed in 7311970d07c4606362081250da95f2c7901fc0db; From c5ebcedb566ef17bda7b02686e0d658a7bb42ee7 · fixed in 4f6fc782128355931527cefe3eb45338abd8ab39

  • Linux Linux

    3.7

  • KernelLinux

    From 3.7.0 · fixed in 5.4.295; From 5.5.0 · fixed in 5.10.239; From 5.11.0 · fixed in 5.15.186; From 5.16.0 · fixed in 6.1.142; From 6.2.0 · fixed in 6.6.95; From 6.7.0 · fixed in 6.12.35; From 6.13.0 · fixed in 6.15.4

References 8

git.kernel.org