{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-39821", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.139Z", "datePublished": "2025-09-16T13:00:20.805Z", "dateUpdated": "2026-08-05T12:05:25.973Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:05:25.973Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf: Avoid undefined behavior from stopping/starting inactive events\n\nCalling pmu->start()/stop() on perf events in PERF_EVENT_STATE_OFF can\nleave event->hw.idx at -1. When PMU drivers later attempt to use this\nnegative index as a shift exponent in bitwise operations, it leads to UBSAN\nshift-out-of-bounds reports.\n\nThe issue is a logical flaw in how event groups handle throttling when some\nmembers are intentionally disabled. Based on the analysis and the\nreproducer provided by Mark Rutland (this issue on both arm64 and x86-64).\n\nThe scenario unfolds as follows:\n\n 1. A group leader event is configured with a very aggressive sampling\n period (e.g., sample_period = 1). This causes frequent interrupts and\n triggers the throttling mechanism.\n 2. A child event in the same group is created in a disabled state\n (.disabled = 1). This event remains in PERF_EVENT_STATE_OFF.\n Since it hasn't been scheduled onto the PMU, its event->hw.idx remains\n initialized at -1.\n 3. When throttling occurs, perf_event_throttle_group() and later\n perf_event_unthrottle_group() iterate through all siblings, including\n the disabled child event.\n 4. perf_event_throttle()/unthrottle() are called on this inactive child\n event, which then call event->pmu->start()/stop().\n 5. The PMU driver receives the event with hw.idx == -1 and attempts to\n use it as a shift exponent. e.g., in macros like PMCNTENSET(idx),\n leading to the UBSAN report.\n\nThe throttling mechanism attempts to start/stop events that are not\nactively scheduled on the hardware.\n\nMove the state check into perf_event_throttle()/perf_event_unthrottle() so\nthat inactive events are skipped entirely. This ensures only active events\nwith a valid hw.idx are processed, preventing undefined behavior and\nsilencing UBSAN warnings. The corrected check ensures true before\nproceeding with PMU operations.\n\nThe problem can be reproduced with the syzkaller reproducer:" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerability is reached exclusively through the `perf_event_open(2)` syscall and `ioctl(PERF_EVENT_IOC_PERIOD)` on the resulting fd; there is no network or remote-peer input path into the perf throttling code.\nAC:L - The attacker fully controls both halves — the group leader's `sample_period=1` deterministically forces throttling within milliseconds, and the disabled sibling is created by the attacker; there is no race or memory-layout condition outside their influence, and the UAF window length is itself chosen via the sibling's `sample_period`.\nPR:L - At the mainline default `kernel.perf_event_paranoid=2`, an unprivileged local user can open a task-scoped sampling group with `exclude_kernel=1` and no capabilities (`perf_allow_kernel()` is only invoked for `!exclude_kernel`), and software cpu-clock/task-clock events need no hardware PMU, so the bug is reachable from containers and VMs.\nUI:N - The attacking process performs the entire sequence — create group, force throttle, wait for unthrottle, close the fds — with no action by any other user or victim process.\nS:U - The corruption is confined to kernel memory and PMU state within the same security authority; no hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - A `perf_event` is freed while its embedded `hw.hrtimer` remains enqueued on the per-CPU hrtimer base, giving a use-after-free over an attacker-timed window that can be reclaimed and read back through the timer machinery; the x86 path additionally performs an out-of-bounds `bt` read below `cpuc->active_mask`.\nI:H - The dangling hrtimer means `__run_hrtimer()` calls `timer->function` from reclaimed heap memory, a direct control-flow hijack primitive after a heap spray; the x86 `btr` at bit offset -1 is also an out-of-bounds bit write into the adjacent per-CPU `cpu_hw_events` pointer.\nA:H - Even without exploitation the bug reliably produces kernel oopses from the freed-timer dereference, and the arm64 path hits a non-`_ONCE` `WARN(1, \"Invalid PMEV* index\")` plus a UBSAN shift-out-of-bounds report on every trigger — an unprivileged panic under `panic_on_warn`/`ubsan_panic` and log flooding otherwise." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "kernel/events/core.c" ], "versions": [ { "version": "9734e25fbf5ae68eb04234b2cd14a4b36ab89141", "lessThan": "d689135aa9c5e4e0eab5a92bbe35dab0c8d6677f", "status": "affected", "versionType": "git" }, { "version": "9734e25fbf5ae68eb04234b2cd14a4b36ab89141", "lessThan": "b64fdd422a85025b5e91ead794db9d3ef970e369", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "kernel/events/core.c" ], "versions": [ { "version": "6.16", "status": "affected" }, { "version": "0", "lessThan": "6.16", "status": "unaffected", "versionType": "semver" }, { "version": "6.16.5", "lessThanOrEqual": "6.16.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.17", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.16.5" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.17" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/d689135aa9c5e4e0eab5a92bbe35dab0c8d6677f" }, { "url": "https://git.kernel.org/stable/c/b64fdd422a85025b5e91ead794db9d3ef970e369" } ], "title": "perf: Avoid undefined behavior from stopping/starting inactive events", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "cvssV3_1": { "scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH" } }, { "other": { "type": "ssvc", "content": { "id": "CVE-2025-39821", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "version": "2.0.3", "timestamp": "2026-01-14T18:16:47.835074Z" } } } ], "problemTypes": [ { "descriptions": [ { "lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write" } ] } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-14T18:22:56.192Z" } } ] } }