CVE-2025-39821 (GCVE-0-2025-39821)
Vulnerability from cvelistv5
Published
2025-09-16 13:00
Modified
2025-09-16 13:00
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
perf: Avoid undefined behavior from stopping/starting inactive events
Calling pmu->start()/stop() on perf events in PERF_EVENT_STATE_OFF can
leave event->hw.idx at -1. When PMU drivers later attempt to use this
negative index as a shift exponent in bitwise operations, it leads to UBSAN
shift-out-of-bounds reports.
The issue is a logical flaw in how event groups handle throttling when some
members are intentionally disabled. Based on the analysis and the
reproducer provided by Mark Rutland (this issue on both arm64 and x86-64).
The scenario unfolds as follows:
1. A group leader event is configured with a very aggressive sampling
period (e.g., sample_period = 1). This causes frequent interrupts and
triggers the throttling mechanism.
2. A child event in the same group is created in a disabled state
(.disabled = 1). This event remains in PERF_EVENT_STATE_OFF.
Since it hasn't been scheduled onto the PMU, its event->hw.idx remains
initialized at -1.
3. When throttling occurs, perf_event_throttle_group() and later
perf_event_unthrottle_group() iterate through all siblings, including
the disabled child event.
4. perf_event_throttle()/unthrottle() are called on this inactive child
event, which then call event->pmu->start()/stop().
5. The PMU driver receives the event with hw.idx == -1 and attempts to
use it as a shift exponent. e.g., in macros like PMCNTENSET(idx),
leading to the UBSAN report.
The throttling mechanism attempts to start/stop events that are not
actively scheduled on the hardware.
Move the state check into perf_event_throttle()/perf_event_unthrottle() so
that inactive events are skipped entirely. This ensures only active events
with a valid hw.idx are processed, preventing undefined behavior and
silencing UBSAN warnings. The corrected check ensures true before
proceeding with PMU operations.
The problem can be reproduced with the syzkaller reproducer:
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/events/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d689135aa9c5e4e0eab5a92bbe35dab0c8d6677f",
"status": "affected",
"version": "9734e25fbf5ae68eb04234b2cd14a4b36ab89141",
"versionType": "git"
},
{
"lessThan": "b64fdd422a85025b5e91ead794db9d3ef970e369",
"status": "affected",
"version": "9734e25fbf5ae68eb04234b2cd14a4b36ab89141",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/events/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.16"
},
{
"lessThan": "6.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.16.*",
"status": "unaffected",
"version": "6.16.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.17-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.16.5",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17-rc3",
"versionStartIncluding": "6.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf: Avoid undefined behavior from stopping/starting inactive events\n\nCalling pmu-\u003estart()/stop() on perf events in PERF_EVENT_STATE_OFF can\nleave event-\u003ehw.idx at -1. When PMU drivers later attempt to use this\nnegative index as a shift exponent in bitwise operations, it leads to UBSAN\nshift-out-of-bounds reports.\n\nThe issue is a logical flaw in how event groups handle throttling when some\nmembers are intentionally disabled. Based on the analysis and the\nreproducer provided by Mark Rutland (this issue on both arm64 and x86-64).\n\nThe scenario unfolds as follows:\n\n 1. A group leader event is configured with a very aggressive sampling\n period (e.g., sample_period = 1). This causes frequent interrupts and\n triggers the throttling mechanism.\n 2. A child event in the same group is created in a disabled state\n (.disabled = 1). This event remains in PERF_EVENT_STATE_OFF.\n Since it hasn\u0027t been scheduled onto the PMU, its event-\u003ehw.idx remains\n initialized at -1.\n 3. When throttling occurs, perf_event_throttle_group() and later\n perf_event_unthrottle_group() iterate through all siblings, including\n the disabled child event.\n 4. perf_event_throttle()/unthrottle() are called on this inactive child\n event, which then call event-\u003epmu-\u003estart()/stop().\n 5. The PMU driver receives the event with hw.idx == -1 and attempts to\n use it as a shift exponent. e.g., in macros like PMCNTENSET(idx),\n leading to the UBSAN report.\n\nThe throttling mechanism attempts to start/stop events that are not\nactively scheduled on the hardware.\n\nMove the state check into perf_event_throttle()/perf_event_unthrottle() so\nthat inactive events are skipped entirely. This ensures only active events\nwith a valid hw.idx are processed, preventing undefined behavior and\nsilencing UBSAN warnings. The corrected check ensures true before\nproceeding with PMU operations.\n\nThe problem can be reproduced with the syzkaller reproducer:"
}
],
"providerMetadata": {
"dateUpdated": "2025-09-16T13:00:20.805Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d689135aa9c5e4e0eab5a92bbe35dab0c8d6677f"
},
{
"url": "https://git.kernel.org/stable/c/b64fdd422a85025b5e91ead794db9d3ef970e369"
}
],
"title": "perf: Avoid undefined behavior from stopping/starting inactive events",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-39821",
"datePublished": "2025-09-16T13:00:20.805Z",
"dateReserved": "2025-04-16T07:20:57.139Z",
"dateUpdated": "2025-09-16T13:00:20.805Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2025-39821\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-09-16T13:15:59.300\",\"lastModified\":\"2025-09-17T14:18:55.093\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nperf: Avoid undefined behavior from stopping/starting inactive events\\n\\nCalling pmu-\u003estart()/stop() on perf events in PERF_EVENT_STATE_OFF can\\nleave event-\u003ehw.idx at -1. When PMU drivers later attempt to use this\\nnegative index as a shift exponent in bitwise operations, it leads to UBSAN\\nshift-out-of-bounds reports.\\n\\nThe issue is a logical flaw in how event groups handle throttling when some\\nmembers are intentionally disabled. Based on the analysis and the\\nreproducer provided by Mark Rutland (this issue on both arm64 and x86-64).\\n\\nThe scenario unfolds as follows:\\n\\n 1. A group leader event is configured with a very aggressive sampling\\n period (e.g., sample_period = 1). This causes frequent interrupts and\\n triggers the throttling mechanism.\\n 2. A child event in the same group is created in a disabled state\\n (.disabled = 1). This event remains in PERF_EVENT_STATE_OFF.\\n Since it hasn\u0027t been scheduled onto the PMU, its event-\u003ehw.idx remains\\n initialized at -1.\\n 3. When throttling occurs, perf_event_throttle_group() and later\\n perf_event_unthrottle_group() iterate through all siblings, including\\n the disabled child event.\\n 4. perf_event_throttle()/unthrottle() are called on this inactive child\\n event, which then call event-\u003epmu-\u003estart()/stop().\\n 5. The PMU driver receives the event with hw.idx == -1 and attempts to\\n use it as a shift exponent. e.g., in macros like PMCNTENSET(idx),\\n leading to the UBSAN report.\\n\\nThe throttling mechanism attempts to start/stop events that are not\\nactively scheduled on the hardware.\\n\\nMove the state check into perf_event_throttle()/perf_event_unthrottle() so\\nthat inactive events are skipped entirely. This ensures only active events\\nwith a valid hw.idx are processed, preventing undefined behavior and\\nsilencing UBSAN warnings. The corrected check ensures true before\\nproceeding with PMU operations.\\n\\nThe problem can be reproduced with the syzkaller reproducer:\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/b64fdd422a85025b5e91ead794db9d3ef970e369\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d689135aa9c5e4e0eab5a92bbe35dab0c8d6677f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…