{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-38168", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:23.991Z", "datePublished": "2025-07-03T08:36:07.620Z", "dateUpdated": "2026-08-05T12:00:00.949Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:00:00.949Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf: arm-ni: Unregister PMUs on probe failure\n\nWhen a resource allocation fails in one clock domain of an NI device,\nwe need to properly roll back all previously registered perf PMUs in\nother clock domains of the same device.\n\nOtherwise, it can lead to kernel panics.\n\nCalling arm_ni_init+0x0/0xff8 [arm_ni] @ 2374\narm-ni ARMHCB70:00: Failed to request PMU region 0x1f3c13000\narm-ni ARMHCB70:00: probe with driver arm-ni failed with error -16\nlist_add corruption: next->prev should be prev (fffffd01e9698a18),\nbut was 0000000000000000. (next=ffff10001a0decc8).\npstate: 6340009 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)\npc : list_add_valid_or_report+0x7c/0xb8\nlr : list_add_valid_or_report+0x7c/0xb8\nCall trace:\n __list_add_valid_or_report+0x7c/0xb8\n perf_pmu_register+0x22c/0x3a0\n arm_ni_probe+0x554/0x70c [arm_ni]\n platform_probe+0x70/0xe8\n really_probe+0xc6/0x4d8\n driver_probe_device+0x48/0x170\n __driver_attach+0x8e/0x1c0\n bus_for_each_dev+0x64/0xf0\n driver_add+0x138/0x260\n bus_add_driver+0x68/0x138\n __platform_driver_register+0x2c/0x40\n arm_ni_init+0x14/0x2a [arm_ni]\n do_init_module+0x36/0x298\n---[ end trace 0000000000000000 ]---\nKernel panic - not syncing: Oops - BUG: Fatal exception\nSMP: stopping secondary CPUs" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerability is in an arm64 platform PMU driver's probe path and the resulting dangling `struct pmu` is exercised through local interfaces — `perf_event_open(2)` and `/sys/bus/event_source/devices/` — with no network or remote-peer input involved. Physical access is not required since the driver binds from firmware-described ACPI/DT platform devices.\nAC:L - On an affected system the probe failure is deterministic and repeatable (the overlapping PMU region fails identically on every load), and the resulting dangling PMU persists in the global `pmus` list, so the attacker's follow-on `perf_event_open()`/sysfs access is fully under their control and can be retried indefinitely to win any heap-reallocation attempt.\nPR:L - The dangling-PMU state is created by the kernel itself during boot-time probe with no attacker involvement, and reaching the freed object afterwards requires only an unprivileged local account — `perf_event_open()` walks the `pmus` list before any `perf_event_paranoid` check, and the PMU sysfs attributes are world-readable at mode 0444.\nUI:N - No victim action is needed; the vulnerable state arises automatically when the driver probes at boot or on module autoload, and the attacker triggers the use-after-free with a plain syscall or sysfs read.\nS:U - The freed memory, the corrupted list, and the hijackable function pointers are all kernel-resident, so the impact stays within the kernel's own security authority with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - The registered PMUs outlive the `devm_kzalloc()`'d `struct arm_ni` that embeds them, so the world-readable `arm_ni_cpumask_show`/format/identifier attributes dereference freed slab memory via `pmu_to_cd()`/`cd_to_ni()`, disclosing whatever data has since been reallocated into that chunk.\nI:H - This is a use-after-free on a `struct pmu` whose ops table is invoked from `perf_init_event()` — spraying the reclaimed devres allocation gives an attacker-controlled `pmu->event_init` indirect call and thus kernel control-flow hijack, and the stale `list_head` additionally causes writes through a freed pointer.\nA:H - The commit message documents the actual observed result: `list_add` corruption in `perf_pmu_register()` leading to `Kernel panic - not syncing: Oops - BUG: Fatal exception` with secondary CPUs stopped, a complete system denial of service." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/perf/arm-ni.c" ], "versions": [ { "version": "4d5a7680f2b4d0c2955e1d9f9a594b050d637436", "lessThan": "7e958e116e3be05a1f869b5a885fc5d674c7725f", "status": "affected", "versionType": "git" }, { "version": "4d5a7680f2b4d0c2955e1d9f9a594b050d637436", "lessThan": "72caf9886e9c1731cf7bfe3eabc308b9268b21d6", "status": "affected", "versionType": "git" }, { "version": "4d5a7680f2b4d0c2955e1d9f9a594b050d637436", "lessThan": "7f57afde6a44d9e044885e1125034edd4fda02e8", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/perf/arm-ni.c" ], "versions": [ { "version": "6.12", "status": "affected" }, { "version": "0", "lessThan": "6.12", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.34", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.15.3", "lessThanOrEqual": "6.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.16", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.12.34" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.15.3" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.16" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/7e958e116e3be05a1f869b5a885fc5d674c7725f" }, { "url": "https://git.kernel.org/stable/c/72caf9886e9c1731cf7bfe3eabc308b9268b21d6" }, { "url": "https://git.kernel.org/stable/c/7f57afde6a44d9e044885e1125034edd4fda02e8" } ], "title": "perf: arm-ni: Unregister PMUs on probe failure", "x_generator": { "engine": "bippy-1.2.0" } } } }