CVE-2025-38563 (GCVE-0-2025-38563)
Vulnerability from cvelistv5
Published
2025-08-19 17:02
Modified
2025-08-28 14:43
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: perf/core: Prevent VMA split of buffer mappings The perf mmap code is careful about mmap()'ing the user page with the ringbuffer and additionally the auxiliary buffer, when the event supports it. Once the first mapping is established, subsequent mapping have to use the same offset and the same size in both cases. The reference counting for the ringbuffer and the auxiliary buffer depends on this being correct. Though perf does not prevent that a related mapping is split via mmap(2), munmap(2) or mremap(2). A split of a VMA results in perf_mmap_open() calls, which take reference counts, but then the subsequent perf_mmap_close() calls are not longer fulfilling the offset and size checks. This leads to reference count leaks. As perf already has the requirement for subsequent mappings to match the initial mapping, the obvious consequence is that VMA splits, caused by resizing of a mapping or partial unmapping, have to be prevented. Implement the vm_operations_struct::may_split() callback and return unconditionally -EINVAL. That ensures that the mapping offsets and sizes cannot be changed after the fact. Remapping to a different fixed address with the same size is still possible as it takes the references for the new mapping and drops those of the old mapping.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/3bd518cc7ea61076bcd725e36ff0e690754977c0
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/65311aad4c808bedad0c05d9bb8b06c47dae73eb
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/6757a31a8e295ae4f01717a954afda173f25a121
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/7b84cb58d1f0aa07656802eae24689566e5f5b1b
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/b024d7b56c77191cde544f838debb7f8451cd0d6
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/d52451a9210f2e5a079ba052918c93563518a9ff
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/e4346ffec2c44d6b0be834d59b20632b5bb5729e
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/e529888b7e8092912dd8789bdfc76685ccd2ff5f
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/ff668930871e0198c7f4e325058b8b7c286787bd
Impacted products
Vendor Product Version
Linux Linux Version: 45bfb2e50471abbbfd83d40d28c986078b0d24ff
Version: 45bfb2e50471abbbfd83d40d28c986078b0d24ff
Version: 45bfb2e50471abbbfd83d40d28c986078b0d24ff
Version: 45bfb2e50471abbbfd83d40d28c986078b0d24ff
Version: 45bfb2e50471abbbfd83d40d28c986078b0d24ff
Version: 45bfb2e50471abbbfd83d40d28c986078b0d24ff
Version: 45bfb2e50471abbbfd83d40d28c986078b0d24ff
Version: 45bfb2e50471abbbfd83d40d28c986078b0d24ff
Version: 45bfb2e50471abbbfd83d40d28c986078b0d24ff
 Create a notification for this product.
   Linux Linux Version: 4.1
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/events/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e4346ffec2c44d6b0be834d59b20632b5bb5729e",
              "status": "affected",
              "version": "45bfb2e50471abbbfd83d40d28c986078b0d24ff",
              "versionType": "git"
            },
            {
              "lessThan": "d52451a9210f2e5a079ba052918c93563518a9ff",
              "status": "affected",
              "version": "45bfb2e50471abbbfd83d40d28c986078b0d24ff",
              "versionType": "git"
            },
            {
              "lessThan": "3bd518cc7ea61076bcd725e36ff0e690754977c0",
              "status": "affected",
              "version": "45bfb2e50471abbbfd83d40d28c986078b0d24ff",
              "versionType": "git"
            },
            {
              "lessThan": "7b84cb58d1f0aa07656802eae24689566e5f5b1b",
              "status": "affected",
              "version": "45bfb2e50471abbbfd83d40d28c986078b0d24ff",
              "versionType": "git"
            },
            {
              "lessThan": "6757a31a8e295ae4f01717a954afda173f25a121",
              "status": "affected",
              "version": "45bfb2e50471abbbfd83d40d28c986078b0d24ff",
              "versionType": "git"
            },
            {
              "lessThan": "e529888b7e8092912dd8789bdfc76685ccd2ff5f",
              "status": "affected",
              "version": "45bfb2e50471abbbfd83d40d28c986078b0d24ff",
              "versionType": "git"
            },
            {
              "lessThan": "ff668930871e0198c7f4e325058b8b7c286787bd",
              "status": "affected",
              "version": "45bfb2e50471abbbfd83d40d28c986078b0d24ff",
              "versionType": "git"
            },
            {
              "lessThan": "65311aad4c808bedad0c05d9bb8b06c47dae73eb",
              "status": "affected",
              "version": "45bfb2e50471abbbfd83d40d28c986078b0d24ff",
              "versionType": "git"
            },
            {
              "lessThan": "b024d7b56c77191cde544f838debb7f8451cd0d6",
              "status": "affected",
              "version": "45bfb2e50471abbbfd83d40d28c986078b0d24ff",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/events/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.1"
            },
            {
              "lessThan": "4.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.297",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.241",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.190",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.102",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.297",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.241",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.190",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.148",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.102",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.42",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.10",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.1",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17-rc1",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf/core: Prevent VMA split of buffer mappings\n\nThe perf mmap code is careful about mmap()\u0027ing the user page with the\nringbuffer and additionally the auxiliary buffer, when the event supports\nit. Once the first mapping is established, subsequent mapping have to use\nthe same offset and the same size in both cases. The reference counting for\nthe ringbuffer and the auxiliary buffer depends on this being correct.\n\nThough perf does not prevent that a related mapping is split via mmap(2),\nmunmap(2) or mremap(2). A split of a VMA results in perf_mmap_open() calls,\nwhich take reference counts, but then the subsequent perf_mmap_close()\ncalls are not longer fulfilling the offset and size checks. This leads to\nreference count leaks.\n\nAs perf already has the requirement for subsequent mappings to match the\ninitial mapping, the obvious consequence is that VMA splits, caused by\nresizing of a mapping or partial unmapping, have to be prevented.\n\nImplement the vm_operations_struct::may_split() callback and return\nunconditionally -EINVAL.\n\nThat ensures that the mapping offsets and sizes cannot be changed after the\nfact. Remapping to a different fixed address with the same size is still\npossible as it takes the references for the new mapping and drops those of\nthe old mapping."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-28T14:43:48.629Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e4346ffec2c44d6b0be834d59b20632b5bb5729e"
        },
        {
          "url": "https://git.kernel.org/stable/c/d52451a9210f2e5a079ba052918c93563518a9ff"
        },
        {
          "url": "https://git.kernel.org/stable/c/3bd518cc7ea61076bcd725e36ff0e690754977c0"
        },
        {
          "url": "https://git.kernel.org/stable/c/7b84cb58d1f0aa07656802eae24689566e5f5b1b"
        },
        {
          "url": "https://git.kernel.org/stable/c/6757a31a8e295ae4f01717a954afda173f25a121"
        },
        {
          "url": "https://git.kernel.org/stable/c/e529888b7e8092912dd8789bdfc76685ccd2ff5f"
        },
        {
          "url": "https://git.kernel.org/stable/c/ff668930871e0198c7f4e325058b8b7c286787bd"
        },
        {
          "url": "https://git.kernel.org/stable/c/65311aad4c808bedad0c05d9bb8b06c47dae73eb"
        },
        {
          "url": "https://git.kernel.org/stable/c/b024d7b56c77191cde544f838debb7f8451cd0d6"
        }
      ],
      "title": "perf/core: Prevent VMA split of buffer mappings",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38563",
    "datePublished": "2025-08-19T17:02:40.249Z",
    "dateReserved": "2025-04-16T04:51:24.025Z",
    "dateUpdated": "2025-08-28T14:43:48.629Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38563\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-08-19T17:15:32.790\",\"lastModified\":\"2025-08-28T15:15:53.200\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nperf/core: Prevent VMA split of buffer mappings\\n\\nThe perf mmap code is careful about mmap()\u0027ing the user page with the\\nringbuffer and additionally the auxiliary buffer, when the event supports\\nit. Once the first mapping is established, subsequent mapping have to use\\nthe same offset and the same size in both cases. The reference counting for\\nthe ringbuffer and the auxiliary buffer depends on this being correct.\\n\\nThough perf does not prevent that a related mapping is split via mmap(2),\\nmunmap(2) or mremap(2). A split of a VMA results in perf_mmap_open() calls,\\nwhich take reference counts, but then the subsequent perf_mmap_close()\\ncalls are not longer fulfilling the offset and size checks. This leads to\\nreference count leaks.\\n\\nAs perf already has the requirement for subsequent mappings to match the\\ninitial mapping, the obvious consequence is that VMA splits, caused by\\nresizing of a mapping or partial unmapping, have to be prevented.\\n\\nImplement the vm_operations_struct::may_split() callback and return\\nunconditionally -EINVAL.\\n\\nThat ensures that the mapping offsets and sizes cannot be changed after the\\nfact. Remapping to a different fixed address with the same size is still\\npossible as it takes the references for the new mapping and drops those of\\nthe old mapping.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: perf/core: Prevenir la divisi\u00f3n de VMA de las asignaciones de b\u00fafer El c\u00f3digo perf mmap es cuidadoso al realizar mmap() en la p\u00e1gina de usuario con el b\u00fafer de anillo y, adicionalmente, el b\u00fafer auxiliar, cuando el evento lo admite. Una vez que se establece la primera asignaci\u00f3n, las asignaciones posteriores deben usar el mismo desplazamiento y el mismo tama\u00f1o en ambos casos. El recuento de referencias para el b\u00fafer de anillo y el b\u00fafer auxiliar depende de que esto sea correcto. Aunque perf no impide que una asignaci\u00f3n relacionada se divida mediante mmap(2), munmap(2) o mremap(2). Una divisi\u00f3n de una VMA da como resultado llamadas a perf_mmap_open(), que toman recuentos de referencias, pero luego las llamadas perf_mmap_close() posteriores ya no cumplen con las comprobaciones de desplazamiento y tama\u00f1o. Esto conduce a fugas de recuento de referencias. Como perf ya tiene el requisito de que las asignaciones posteriores coincidan con la asignaci\u00f3n inicial, la consecuencia obvia es que se deben evitar las divisiones de VMA, causadas por el cambio de tama\u00f1o de una asignaci\u00f3n o la desasignaci\u00f3n parcial. Implemente la funci\u00f3n de retorno vm_operations_struct::may_split() y devuelva incondicionalmente -EINVAL. Esto garantiza que los desplazamientos y tama\u00f1os de la asignaci\u00f3n no se puedan modificar posteriormente. La reasignaci\u00f3n a una direcci\u00f3n fija diferente con el mismo tama\u00f1o sigue siendo posible, ya que toma las referencias de la nueva asignaci\u00f3n y descarta las de la asignaci\u00f3n anterior.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3bd518cc7ea61076bcd725e36ff0e690754977c0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/65311aad4c808bedad0c05d9bb8b06c47dae73eb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6757a31a8e295ae4f01717a954afda173f25a121\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7b84cb58d1f0aa07656802eae24689566e5f5b1b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b024d7b56c77191cde544f838debb7f8451cd0d6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d52451a9210f2e5a079ba052918c93563518a9ff\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e4346ffec2c44d6b0be834d59b20632b5bb5729e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e529888b7e8092912dd8789bdfc76685ccd2ff5f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ff668930871e0198c7f4e325058b8b7c286787bd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.