CVE-2025-38322 (GCVE-0-2025-38322)
Vulnerability from cvelistv5
Published
2025-07-10 08:14
Modified
2025-09-25 09:49
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: Fix crash in icl_update_topdown_event() The perf_fuzzer found a hard-lockup crash on a RaptorLake machine: Oops: general protection fault, maybe for address 0xffff89aeceab400: 0000 CPU: 23 UID: 0 PID: 0 Comm: swapper/23 Tainted: [W]=WARN Hardware name: Dell Inc. Precision 9660/0VJ762 RIP: 0010:native_read_pmc+0x7/0x40 Code: cc e8 8d a9 01 00 48 89 03 5b cd cc cc cc cc 0f 1f ... RSP: 000:fffb03100273de8 EFLAGS: 00010046 .... Call Trace: <TASK> icl_update_topdown_event+0x165/0x190 ? ktime_get+0x38/0xd0 intel_pmu_read_event+0xf9/0x210 __perf_event_read+0xf9/0x210 CPUs 16-23 are E-core CPUs that don't support the perf metrics feature. The icl_update_topdown_event() should not be invoked on these CPUs. It's a regression of commit: f9bdf1f95339 ("perf/x86/intel: Avoid disable PMU if !cpuc->enabled in sample read") The bug introduced by that commit is that the is_topdown_event() function is mistakenly used to replace the is_topdown_count() call to check if the topdown functions for the perf metrics feature should be invoked. Fix it.
References
Impacted products
Vendor Product Version
Linux Linux Version: 781b2db0eb7731fbde510c268b7ccc62959c3feb
Version: e7f6922c8a5b41522a8329ea6bbf815993b2dd28
Version: 3a8bec6583e5239de3bd597ab382dc6c2b0c29a1
Version: f9bdf1f953392c9edd69a7f884f78c0390127029
Version: f9bdf1f953392c9edd69a7f884f78c0390127029
Version: 06cd7bfbb86e9db3e9013ea6636ad2c6f0a1664d
Version: d8370aa704bd7e384918c8f466856374725c0585
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/events/intel/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "702ea6028032d6c1fe96c2d4762a3575e3654819",
              "status": "affected",
              "version": "781b2db0eb7731fbde510c268b7ccc62959c3feb",
              "versionType": "git"
            },
            {
              "lessThan": "79e2dd573116d3338507c311460da9669095c94d",
              "status": "affected",
              "version": "e7f6922c8a5b41522a8329ea6bbf815993b2dd28",
              "versionType": "git"
            },
            {
              "lessThan": "e97c45c770f5e56c784a46c2a96ab968d26b97d9",
              "status": "affected",
              "version": "3a8bec6583e5239de3bd597ab382dc6c2b0c29a1",
              "versionType": "git"
            },
            {
              "lessThan": "a85cc69acdcb05f8cd226b8ea0778b8e2e887e6f",
              "status": "affected",
              "version": "f9bdf1f953392c9edd69a7f884f78c0390127029",
              "versionType": "git"
            },
            {
              "lessThan": "b0823d5fbacb1c551d793cbfe7af24e0d1fa45ed",
              "status": "affected",
              "version": "f9bdf1f953392c9edd69a7f884f78c0390127029",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "06cd7bfbb86e9db3e9013ea6636ad2c6f0a1664d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d8370aa704bd7e384918c8f466856374725c0585",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/events/intel/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.15"
            },
            {
              "lessThan": "6.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.149",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.49",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.149",
                  "versionStartIncluding": "6.1.134",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.101",
                  "versionStartIncluding": "6.6.87",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.49",
                  "versionStartIncluding": "6.12.23",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.4",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.13.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.14.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf/x86/intel: Fix crash in icl_update_topdown_event()\n\nThe perf_fuzzer found a hard-lockup crash on a RaptorLake machine:\n\n  Oops: general protection fault, maybe for address 0xffff89aeceab400: 0000\n  CPU: 23 UID: 0 PID: 0 Comm: swapper/23\n  Tainted: [W]=WARN\n  Hardware name: Dell Inc. Precision 9660/0VJ762\n  RIP: 0010:native_read_pmc+0x7/0x40\n  Code: cc e8 8d a9 01 00 48 89 03 5b cd cc cc cc cc 0f 1f ...\n  RSP: 000:fffb03100273de8 EFLAGS: 00010046\n  ....\n  Call Trace:\n    \u003cTASK\u003e\n    icl_update_topdown_event+0x165/0x190\n    ? ktime_get+0x38/0xd0\n    intel_pmu_read_event+0xf9/0x210\n    __perf_event_read+0xf9/0x210\n\nCPUs 16-23 are E-core CPUs that don\u0027t support the perf metrics feature.\nThe icl_update_topdown_event() should not be invoked on these CPUs.\n\nIt\u0027s a regression of commit:\n\n  f9bdf1f95339 (\"perf/x86/intel: Avoid disable PMU if !cpuc-\u003eenabled in sample read\")\n\nThe bug introduced by that commit is that the is_topdown_event() function\nis mistakenly used to replace the is_topdown_count() call to check if the\ntopdown functions for the perf metrics feature should be invoked.\n\nFix it."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-25T09:49:09.566Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/702ea6028032d6c1fe96c2d4762a3575e3654819"
        },
        {
          "url": "https://git.kernel.org/stable/c/79e2dd573116d3338507c311460da9669095c94d"
        },
        {
          "url": "https://git.kernel.org/stable/c/e97c45c770f5e56c784a46c2a96ab968d26b97d9"
        },
        {
          "url": "https://git.kernel.org/stable/c/a85cc69acdcb05f8cd226b8ea0778b8e2e887e6f"
        },
        {
          "url": "https://git.kernel.org/stable/c/b0823d5fbacb1c551d793cbfe7af24e0d1fa45ed"
        }
      ],
      "title": "perf/x86/intel: Fix crash in icl_update_topdown_event()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38322",
    "datePublished": "2025-07-10T08:14:57.603Z",
    "dateReserved": "2025-04-16T04:51:24.004Z",
    "dateUpdated": "2025-09-25T09:49:09.566Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38322\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-07-10T09:15:26.240\",\"lastModified\":\"2025-09-25T10:15:31.257\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nperf/x86/intel: Fix crash in icl_update_topdown_event()\\n\\nThe perf_fuzzer found a hard-lockup crash on a RaptorLake machine:\\n\\n  Oops: general protection fault, maybe for address 0xffff89aeceab400: 0000\\n  CPU: 23 UID: 0 PID: 0 Comm: swapper/23\\n  Tainted: [W]=WARN\\n  Hardware name: Dell Inc. Precision 9660/0VJ762\\n  RIP: 0010:native_read_pmc+0x7/0x40\\n  Code: cc e8 8d a9 01 00 48 89 03 5b cd cc cc cc cc 0f 1f ...\\n  RSP: 000:fffb03100273de8 EFLAGS: 00010046\\n  ....\\n  Call Trace:\\n    \u003cTASK\u003e\\n    icl_update_topdown_event+0x165/0x190\\n    ? ktime_get+0x38/0xd0\\n    intel_pmu_read_event+0xf9/0x210\\n    __perf_event_read+0xf9/0x210\\n\\nCPUs 16-23 are E-core CPUs that don\u0027t support the perf metrics feature.\\nThe icl_update_topdown_event() should not be invoked on these CPUs.\\n\\nIt\u0027s a regression of commit:\\n\\n  f9bdf1f95339 (\\\"perf/x86/intel: Avoid disable PMU if !cpuc-\u003eenabled in sample read\\\")\\n\\nThe bug introduced by that commit is that the is_topdown_event() function\\nis mistakenly used to replace the is_topdown_count() call to check if the\\ntopdown functions for the perf metrics feature should be invoked.\\n\\nFix it.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: perf/x86/intel: Se corrige un fallo en icl_update_topdown_event(). perf_fuzzer encontr\u00f3 un fallo de bloqueo duro en una m\u00e1quina RaptorLake: Oops: fallo de protecci\u00f3n general, tal vez para la direcci\u00f3n 0xffff89aeceab400: 0000 CPU: 23 UID: 0 PID: 0 Comm: swapper/23 Tainted: [W]=WARN Nombre del hardware: Dell Inc. Precision 9660/0VJ762 RIP: 0010:native_read_pmc+0x7/0x40 C\u00f3digo: cc e8 8d a9 01 00 48 89 03 5b cd cc cc cc cc 0f 1f ... RSP: 000:fffb03100273de8 EFLAGS: 00010046 .... Seguimiento de llamadas:  icl_update_topdown_event+0x165/0x190 ? ktime_get+0x38/0xd0 intel_pmu_read_event+0xf9/0x210 __perf_event_read+0xf9/0x210 Las CPU 16-23 son CPU de n\u00facleo E que no admiten la funci\u00f3n de m\u00e9tricas de rendimiento. No se debe invocar icl_update_topdown_event() en estas CPU. Es una regresi\u00f3n del commit: f9bdf1f95339 (\\\"perf/x86/intel: Evitar deshabilitar PMU si !cpuc-\u0026gt;enabled en la lectura de muestra\\\") El error introducido por esa confirmaci\u00f3n es que la funci\u00f3n is_topdown_event() se usa por error para reemplazar la llamada is_topdown_count() para verificar si se deben invocar las funciones descendentes para la caracter\u00edstica de m\u00e9tricas de rendimiento. Arr\u00e9glenlo.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/702ea6028032d6c1fe96c2d4762a3575e3654819\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/79e2dd573116d3338507c311460da9669095c94d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a85cc69acdcb05f8cd226b8ea0778b8e2e887e6f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b0823d5fbacb1c551d793cbfe7af24e0d1fa45ed\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e97c45c770f5e56c784a46c2a96ab968d26b97d9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.