CVE-2025-21889perf/core: Add RCU read lock protection to perf_iterate_ctx()
Updated under an hour ago ()
Does this affect you?
It affects Linux and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: perf/core: Add RCU read lock protection to perf_iterate_ctx() The perf_iterate_ctx() function performs RCU list traversal but currently lacks RCU read lock protection. This causes lockdep warnings when running perf probe with unshare(1) under CONFIG_PROVE_RCU_LIST=y: WARNING: suspicious RCU usage kernel/events/core.c:8168 RCU-list traversed in non-reader section!! Call Trace: lockdep_rcu_suspicious ? perf_event_addr_filters_apply perf_iterate_ctx perf_event_exec begin_new_exec ? load_elf_phdrs load_elf_binary ? lock_acquire ? find_held_lock ? bprm_execve bprm_execve do_execveat_common.isra.0 __x64_sys_execve do_syscall_64 entry_SYSCALL_64_after_hwframe This protection was previously present but was removed in commit bd2756811766 ("perf: Rewrite core context handling"). Add back the necessary rcu_read_lock()/rcu_read_unlock() pair around perf_iterate_ctx() call in perf_event_exec(). [ mingo: Use scoped_guard() as suggested by Peter ]
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Modified
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 15, 2026
Affected products
Linux Linux linux:linux (from the name) | from bd27568117664b8b3e259721393df420ed51f57b before f390c2eea571945f357a2d3b9fcb1c015767132e; from bd27568117664b8b3e259721393df420ed51f57b before a2475ccad6120546ea45dbcd6cd1f74dc565ef6b; from bd27568117664b8b3e259721393df420ed51f57b before dd536566dda9a551fc2a2acfab5313a5bb13ed02; from bd27568117664b8b3e259721393df420ed51f57b before 0fe8813baf4b2e865d3b2c735ce1a15b86002c74 | CNA record |
linux linux_kernel linux:linux_kernel | from 6.2 before 6.6.81; from 6.7 before 6.12.18; from 6.13 before 6.13.6; 6.14; 6.14; 6.14; 6.14 | NVD |
References
- https://git.kernel.org/stable/c/f390c2eea571945f357a2d3b9fcb1c015767132epatch
- https://git.kernel.org/stable/c/a2475ccad6120546ea45dbcd6cd1f74dc565ef6bpatch
- https://git.kernel.org/stable/c/dd536566dda9a551fc2a2acfab5313a5bb13ed02patch
- https://git.kernel.org/stable/c/0fe8813baf4b2e865d3b2c735ce1a15b86002c74patch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.