CVE-2025-68798: perf/x86/amd: Check event before enable to avoid GPF
In the Linux kernel, the following vulnerability has been resolved:
perf/x86/amd: Check event before enable to avoid GPF
On AMD machines cpuc->events[idx] can become NULL in a subtle race condition with NMI->throttle->x86pmustop().
Check event for NULL in amdpmuenableall() before enable to avoid a GPF. This appears to be an AMD only issue.
Syzkaller reported a GPF in amdpmuenableall.
INFO: NMI handler (perfeventnmihandler) took too long to run: 13.143 msecs Oops: general protection fault, probably for non-canonical address 0xdffffc0000000034: 0000 PREEMPT SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x00000000000001a0-0x00000000000001a7] CPU: 0 UID: 0 PID: 328415 Comm: repro36674776 Not tainted 6.12.0-rc1-syzk RIP: 0010:x86pmuenableevent (arch/x86/events/perfevent.h:1195 arch/x86/events/core.c:1430) RSP: 0018:ffff888118009d60 EFLAGS: 00010012 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000034 RSI: 0000000000000000 RDI: 00000000000001a0 RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000002 R13: ffff88811802a440 R14: ffff88811802a240 R15: ffff8881132d8601 FS: 00007f097dfaa700(0000) GS:ffff888118000000(0000) GS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000200001c0 CR3: 0000000103d56000 CR4: 00000000000006f0 Call Trace: <IRQ> amdpmuenableall (arch/x86/events/amd/core.c:760 (discriminator 2)) x86pmuenable (arch/x86/events/core.c:1360) eventschedout (kernel/events/core.c:1191 kernel/events/core.c:1186 kernel/events/core.c:2346) perfremovefromcontext (kernel/events/core.c:2435) eventfunction (kernel/events/core.c:259) remotefunction (kernel/events/core.c:92 (discriminator 1) kernel/events/core.c:72 (discriminator 1)) flushsmpcallfunctionqueue (./arch/x86/include/asm/jumplabel.h:27 ./include/linux/jumplabel.h:207 ./include/trace/events/csd.h:64 kernel/smp.c:135 kernel/smp.c:540) sysveccallfunctionsingle (./arch/x86/include/asm/jumplabel.h:27 ./include/linux/jumplabel.h:207 ./arch/x86/include/asm/trace/irqvectors.h:99 arch/x86/kernel/smp.c:272) sysveccallfunctionsingle (arch/x86/kernel/smp.c:266 (discriminator 47) arch/x86/kernel/smp.c:266 (discriminator 47)) </IRQ>
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-68798?
CVE-2025-68798 has been classified with a severity that reflects a potential impact on system stability and security due to a race condition.
How do I fix CVE-2025-68798?
To address CVE-2025-68798, it is recommended to update your Linux kernel to the latest version that includes the security fix.
What is the impact of CVE-2025-68798 on AMD machines?
CVE-2025-68798 may cause a General Protection Fault (GPF) in AMD systems due to a race condition between various kernel processes.
Are all Linux kernel versions affected by CVE-2025-68798?
CVE-2025-68798 specifically affects certain versions of the Linux kernel running on AMD hardware, so not all versions are impacted.
What can trigger the vulnerability CVE-2025-68798?
The vulnerability CVE-2025-68798 can be triggered by non-maskable interrupts interacting with the performance monitoring unit on AMD systems.