CVE-2025-38424 (GCVE-0-2025-38424)

Vulnerability from cvelistv5 – Published: 2025-07-25 14:16 – Updated: 2026-05-11 21:27
VLAI
Title
perf: Fix sample vs do_exit()
Summary
In the Linux kernel, the following vulnerability has been resolved: perf: Fix sample vs do_exit() Baisheng Gao reported an ARM64 crash, which Mark decoded as being a synchronous external abort -- most likely due to trying to access MMIO in bad ways. The crash further shows perf trying to do a user stack sample while in exit_mmap()'s tlb_finish_mmu() -- i.e. while tearing down the address space it is trying to access. It turns out that we stop perf after we tear down the userspace mm; a receipie for disaster, since perf likes to access userspace for various reasons. Flip this order by moving up where we stop perf in do_exit(). Additionally, harden PERF_SAMPLE_CALLCHAIN and PERF_SAMPLE_STACK_USER to abort when the current task does not have an mm (exit_mm() makes sure to set current->mm = NULL; before commencing with the actual teardown). Such that CPU wide events don't trip on this same problem.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: c5ebcedb566ef17bda7b02686e0d658a7bb42ee7 , < 7b8f3c72175c6a63a95cf2e219f8b78e2baad34e (git)
Affected: c5ebcedb566ef17bda7b02686e0d658a7bb42ee7 , < 507c9a595bad3abd107c6a8857d7fd125d89f386 (git)
Affected: c5ebcedb566ef17bda7b02686e0d658a7bb42ee7 , < a9f6aab7910a0ef2895797f15c947f6d1053160f (git)
Affected: c5ebcedb566ef17bda7b02686e0d658a7bb42ee7 , < 975ffddfa2e19823c719459d2364fcaa17673964 (git)
Affected: c5ebcedb566ef17bda7b02686e0d658a7bb42ee7 , < 2ee6044a693735396bb47eeaba1ac3ae26c1c99b (git)
Affected: c5ebcedb566ef17bda7b02686e0d658a7bb42ee7 , < 456019adaa2f5366b89c868dea9b483179bece54 (git)
Affected: c5ebcedb566ef17bda7b02686e0d658a7bb42ee7 , < 7311970d07c4606362081250da95f2c7901fc0db (git)
Affected: c5ebcedb566ef17bda7b02686e0d658a7bb42ee7 , < 4f6fc782128355931527cefe3eb45338abd8ab39 (git)
Create a notification for this product.
Linux Linux Affected: 3.7
Unaffected: 0 , < 3.7 (semver)
Unaffected: 5.4.295 , ≤ 5.4.* (semver)
Unaffected: 5.10.239 , ≤ 5.10.* (semver)
Unaffected: 5.15.186 , ≤ 5.15.* (semver)
Unaffected: 6.1.142 , ≤ 6.1.* (semver)
Unaffected: 6.6.95 , ≤ 6.6.* (semver)
Unaffected: 6.12.35 , ≤ 6.12.* (semver)
Unaffected: 6.15.4 , ≤ 6.15.* (semver)
Unaffected: 6.16 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:37:54.380Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/events/core.c",
            "kernel/exit.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7b8f3c72175c6a63a95cf2e219f8b78e2baad34e",
              "status": "affected",
              "version": "c5ebcedb566ef17bda7b02686e0d658a7bb42ee7",
              "versionType": "git"
            },
            {
              "lessThan": "507c9a595bad3abd107c6a8857d7fd125d89f386",
              "status": "affected",
              "version": "c5ebcedb566ef17bda7b02686e0d658a7bb42ee7",
              "versionType": "git"
            },
            {
              "lessThan": "a9f6aab7910a0ef2895797f15c947f6d1053160f",
              "status": "affected",
              "version": "c5ebcedb566ef17bda7b02686e0d658a7bb42ee7",
              "versionType": "git"
            },
            {
              "lessThan": "975ffddfa2e19823c719459d2364fcaa17673964",
              "status": "affected",
              "version": "c5ebcedb566ef17bda7b02686e0d658a7bb42ee7",
              "versionType": "git"
            },
            {
              "lessThan": "2ee6044a693735396bb47eeaba1ac3ae26c1c99b",
              "status": "affected",
              "version": "c5ebcedb566ef17bda7b02686e0d658a7bb42ee7",
              "versionType": "git"
            },
            {
              "lessThan": "456019adaa2f5366b89c868dea9b483179bece54",
              "status": "affected",
              "version": "c5ebcedb566ef17bda7b02686e0d658a7bb42ee7",
              "versionType": "git"
            },
            {
              "lessThan": "7311970d07c4606362081250da95f2c7901fc0db",
              "status": "affected",
              "version": "c5ebcedb566ef17bda7b02686e0d658a7bb42ee7",
              "versionType": "git"
            },
            {
              "lessThan": "4f6fc782128355931527cefe3eb45338abd8ab39",
              "status": "affected",
              "version": "c5ebcedb566ef17bda7b02686e0d658a7bb42ee7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/events/core.c",
            "kernel/exit.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.7"
            },
            {
              "lessThan": "3.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.295",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.239",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.186",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.142",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.295",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.239",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.186",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.142",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.95",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.35",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.4",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf: Fix sample vs do_exit()\n\nBaisheng Gao reported an ARM64 crash, which Mark decoded as being a\nsynchronous external abort -- most likely due to trying to access\nMMIO in bad ways.\n\nThe crash further shows perf trying to do a user stack sample while in\nexit_mmap()\u0027s tlb_finish_mmu() -- i.e. while tearing down the address\nspace it is trying to access.\n\nIt turns out that we stop perf after we tear down the userspace mm; a\nreceipie for disaster, since perf likes to access userspace for\nvarious reasons.\n\nFlip this order by moving up where we stop perf in do_exit().\n\nAdditionally, harden PERF_SAMPLE_CALLCHAIN and PERF_SAMPLE_STACK_USER\nto abort when the current task does not have an mm (exit_mm() makes\nsure to set current-\u003emm = NULL; before commencing with the actual\nteardown). Such that CPU wide events don\u0027t trip on this same problem."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:27:43.069Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7b8f3c72175c6a63a95cf2e219f8b78e2baad34e"
        },
        {
          "url": "https://git.kernel.org/stable/c/507c9a595bad3abd107c6a8857d7fd125d89f386"
        },
        {
          "url": "https://git.kernel.org/stable/c/a9f6aab7910a0ef2895797f15c947f6d1053160f"
        },
        {
          "url": "https://git.kernel.org/stable/c/975ffddfa2e19823c719459d2364fcaa17673964"
        },
        {
          "url": "https://git.kernel.org/stable/c/2ee6044a693735396bb47eeaba1ac3ae26c1c99b"
        },
        {
          "url": "https://git.kernel.org/stable/c/456019adaa2f5366b89c868dea9b483179bece54"
        },
        {
          "url": "https://git.kernel.org/stable/c/7311970d07c4606362081250da95f2c7901fc0db"
        },
        {
          "url": "https://git.kernel.org/stable/c/4f6fc782128355931527cefe3eb45338abd8ab39"
        }
      ],
      "title": "perf: Fix sample vs do_exit()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38424",
    "datePublished": "2025-07-25T14:16:44.846Z",
    "dateReserved": "2025-04-16T04:51:24.014Z",
    "dateUpdated": "2026-05-11T21:27:43.069Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38424",
      "date": "2026-05-25",
      "epss": "0.00066",
      "percentile": "0.20444"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38424\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-07-25T15:15:27.260\",\"lastModified\":\"2025-12-23T18:35:57.093\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nperf: Fix sample vs do_exit()\\n\\nBaisheng Gao reported an ARM64 crash, which Mark decoded as being a\\nsynchronous external abort -- most likely due to trying to access\\nMMIO in bad ways.\\n\\nThe crash further shows perf trying to do a user stack sample while in\\nexit_mmap()\u0027s tlb_finish_mmu() -- i.e. while tearing down the address\\nspace it is trying to access.\\n\\nIt turns out that we stop perf after we tear down the userspace mm; a\\nreceipie for disaster, since perf likes to access userspace for\\nvarious reasons.\\n\\nFlip this order by moving up where we stop perf in do_exit().\\n\\nAdditionally, harden PERF_SAMPLE_CALLCHAIN and PERF_SAMPLE_STACK_USER\\nto abort when the current task does not have an mm (exit_mm() makes\\nsure to set current-\u003emm = NULL; before commencing with the actual\\nteardown). Such that CPU wide events don\u0027t trip on this same problem.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: perf: Fix sample vs do_exit() Baisheng Gao inform\u00f3 de un fallo de ARM64, que Mark decodific\u00f3 como una interrupci\u00f3n externa sincr\u00f3nica, probablemente debido a un intento de acceder a MMIO de forma incorrecta. El fallo muestra adem\u00e1s que perf intenta hacer una muestra de pila de usuario mientras est\u00e1 en tlb_finish_mmu() de exit_mmap(), es decir, mientras derriba el espacio de direcciones al que intenta acceder. Resulta que detenemos perf despu\u00e9s de derribar el mm del espacio de usuario; una receta para el desastre, ya que a perf le gusta acceder al espacio de usuario por varias razones. Invierta este orden subiendo donde detenemos perf en do_exit(). Adem\u00e1s, endurezca PERF_SAMPLE_CALLCHAIN y PERF_SAMPLE_STACK_USER para que se detengan cuando la tarea actual no tenga un mm (exit_mm() se asegura de establecer current-\u0026gt;mm = NULL; antes de comenzar con el desmontaje real). De modo que los eventos de toda la CPU no se activen con este mismo problema.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.7\",\"versionEndExcluding\":\"5.4.295\",\"matchCriteriaId\":\"787938FE-68C1-4295-BECA-110746C6BED4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.239\",\"matchCriteriaId\":\"C3D14F4C-A21E-465D-A928-5CCE684E2B98\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.186\",\"matchCriteriaId\":\"D96F2C0D-0D4A-4658-AD34-D8A626EA422D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.142\",\"matchCriteriaId\":\"459B4E94-FE0E-434D-B782-95E3A5FFC6B1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.95\",\"matchCriteriaId\":\"C5E01853-7048-4D78-9479-9AEE41AC8456\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.35\",\"matchCriteriaId\":\"E569FD34-0076-4428-BE17-EECCF867611C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.15.4\",\"matchCriteriaId\":\"DFD174C5-1AA2-4671-BDDC-1A9FCC753655\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"6D4894DB-CCFE-4602-B1BF-3960B2E19A01\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"09709862-E348-4378-8632-5A7813EDDC86\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA6FEEC2-9F11-4643-8827-749718254FED\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2ee6044a693735396bb47eeaba1ac3ae26c1c99b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/456019adaa2f5366b89c868dea9b483179bece54\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4f6fc782128355931527cefe3eb45338abd8ab39\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/507c9a595bad3abd107c6a8857d7fd125d89f386\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7311970d07c4606362081250da95f2c7901fc0db\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7b8f3c72175c6a63a95cf2e219f8b78e2baad34e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/975ffddfa2e19823c719459d2364fcaa17673964\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a9f6aab7910a0ef2895797f15c947f6d1053160f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"Mailing List\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"Mailing List\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.