CVE-2025-38424: perf: Fix sample vs do_exit()
In the Linux kernel, the following vulnerability has been resolved:
perf: Fix sample vs doexit()
Baisheng Gao reported an ARM64 crash, which Mark decoded as being a synchronous external abort -- most likely due to trying to access MMIO in bad ways.
The crash further shows perf trying to do a user stack sample while in exitmmap()'s tlbfinishmmu() -- i.e. while tearing down the address space it is trying to access.
It turns out that we stop perf after we tear down the userspace mm; a receipie for disaster, since perf likes to access userspace for various reasons.
Flip this order by moving up where we stop perf in doexit().
Additionally, harden PERFSAMPLECALLCHAIN and PERFSAMPLESTACKUSER to abort when the current task does not have an mm (exitmm() makes sure to set current->mm = NULL; before commencing with the actual teardown). Such that CPU wide events don't trip on this same problem.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
Harden PERF_SAMPLE_CALLCHAIN and PERF_SAMPLE_STACK_USER to abort when the current task does not have an mm, and move stopping perf earlier in do_exit() so it occurs before userspace mm teardown.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38424?
CVE-2025-38424 has been classified with a severity level that indicates a risk of system crashes on the Linux Kernel.
How do I fix CVE-2025-38424?
To mitigate CVE-2025-38424, update your Linux kernel to a version that includes the fix for the identified vulnerability.
What type of systems are affected by CVE-2025-38424?
CVE-2025-38424 affects systems running the Linux kernel, particularly those using ARM64 architecture.
What does CVE-2025-38424 involve?
CVE-2025-38424 involves a crash caused by improper access to Memory-Mapped I/O (MMIO) in the Linux kernel.
When was CVE-2025-38424 reported?
CVE-2025-38424 was reported following an ARM64 crash and has led to a resolution in the Linux kernel.