CVE-2025-38564 (GCVE-0-2025-38564)
Vulnerability from cvelistv5
Published
2025-08-19 17:02
Modified
2025-08-19 17:02
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
perf/core: Handle buffer mapping fail correctly in perf_mmap()
After successful allocation of a buffer or a successful attachment to an
existing buffer perf_mmap() tries to map the buffer read only into the page
table. If that fails, the already set up page table entries are zapped, but
the other perf specific side effects of that failure are not handled. The
calling code just cleans up the VMA and does not invoke perf_mmap_close().
This leaks reference counts, corrupts user->vm accounting and also results
in an unbalanced invocation of event::event_mapped().
Cure this by moving the event::event_mapped() invocation before the
map_range() call so that on map_range() failure perf_mmap_close() can be
invoked without causing an unbalanced event::event_unmapped() call.
perf_mmap_close() undoes the reference counts and eventually frees buffers.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/events/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "831e1c90a5d72e6977a57c44f47c46b73a438695",
"status": "affected",
"version": "b709eb872e19a19607bbb6d2975bc264d59735cf",
"versionType": "git"
},
{
"lessThan": "a9025f73c88d9d6e125743a43afc569da3ce5328",
"status": "affected",
"version": "b709eb872e19a19607bbb6d2975bc264d59735cf",
"versionType": "git"
},
{
"lessThan": "f74b9f4ba63ffdf597aaaa6cad7e284cb8e04820",
"status": "affected",
"version": "b709eb872e19a19607bbb6d2975bc264d59735cf",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/events/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.14"
},
{
"lessThan": "6.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.15.*",
"status": "unaffected",
"version": "6.15.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.16.*",
"status": "unaffected",
"version": "6.16.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.17-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.15.10",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.16.1",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17-rc1",
"versionStartIncluding": "6.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf/core: Handle buffer mapping fail correctly in perf_mmap()\n\nAfter successful allocation of a buffer or a successful attachment to an\nexisting buffer perf_mmap() tries to map the buffer read only into the page\ntable. If that fails, the already set up page table entries are zapped, but\nthe other perf specific side effects of that failure are not handled. The\ncalling code just cleans up the VMA and does not invoke perf_mmap_close().\n\nThis leaks reference counts, corrupts user-\u003evm accounting and also results\nin an unbalanced invocation of event::event_mapped().\n\nCure this by moving the event::event_mapped() invocation before the\nmap_range() call so that on map_range() failure perf_mmap_close() can be\ninvoked without causing an unbalanced event::event_unmapped() call.\n\nperf_mmap_close() undoes the reference counts and eventually frees buffers."
}
],
"providerMetadata": {
"dateUpdated": "2025-08-19T17:02:40.942Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/831e1c90a5d72e6977a57c44f47c46b73a438695"
},
{
"url": "https://git.kernel.org/stable/c/a9025f73c88d9d6e125743a43afc569da3ce5328"
},
{
"url": "https://git.kernel.org/stable/c/f74b9f4ba63ffdf597aaaa6cad7e284cb8e04820"
}
],
"title": "perf/core: Handle buffer mapping fail correctly in perf_mmap()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-38564",
"datePublished": "2025-08-19T17:02:40.942Z",
"dateReserved": "2025-04-16T04:51:24.025Z",
"dateUpdated": "2025-08-19T17:02:40.942Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2025-38564\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-08-19T17:15:32.933\",\"lastModified\":\"2025-08-20T14:40:17.713\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nperf/core: Handle buffer mapping fail correctly in perf_mmap()\\n\\nAfter successful allocation of a buffer or a successful attachment to an\\nexisting buffer perf_mmap() tries to map the buffer read only into the page\\ntable. If that fails, the already set up page table entries are zapped, but\\nthe other perf specific side effects of that failure are not handled. The\\ncalling code just cleans up the VMA and does not invoke perf_mmap_close().\\n\\nThis leaks reference counts, corrupts user-\u003evm accounting and also results\\nin an unbalanced invocation of event::event_mapped().\\n\\nCure this by moving the event::event_mapped() invocation before the\\nmap_range() call so that on map_range() failure perf_mmap_close() can be\\ninvoked without causing an unbalanced event::event_unmapped() call.\\n\\nperf_mmap_close() undoes the reference counts and eventually frees buffers.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: perf/core: Manejar el error de mapeo de b\u00fafer correctamente en perf_mmap() Despu\u00e9s de la asignaci\u00f3n exitosa de un b\u00fafer o una conexi\u00f3n exitosa a un b\u00fafer existente, perf_mmap() intenta mapear el b\u00fafer de solo lectura en la tabla de p\u00e1ginas. Si eso falla, las entradas de la tabla de p\u00e1ginas ya configuradas se eliminan, pero los otros efectos secundarios espec\u00edficos de perf de ese fallo no se manejan. El c\u00f3digo de llamada simplemente limpia el VMA y no invoca perf_mmap_close(). Esto filtra los recuentos de referencia, corrompe la contabilidad de usuario-\u0026gt;vm y tambi\u00e9n resulta en una invocaci\u00f3n desequilibrada de event::event_mapped(). Solucione esto moviendo la invocaci\u00f3n de event::event_mapped() antes de la llamada a map_range() para que en el fallo de map_range() se pueda invocar perf_mmap_close() sin causar una llamada desequilibrada a event::event_unmapped(). perf_mmap_close() deshace los recuentos de referencia y eventualmente libera los b\u00faferes.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/831e1c90a5d72e6977a57c44f47c46b73a438695\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a9025f73c88d9d6e125743a43afc569da3ce5328\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f74b9f4ba63ffdf597aaaa6cad7e284cb8e04820\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…