CVE-2025-38424perf: Fix sample vs do_exit()
Updated under an hour ago ()
Does this affect you?
It affects Linux and 2 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: perf: Fix sample vs do_exit() Baisheng Gao reported an ARM64 crash, which Mark decoded as being a synchronous external abort -- most likely due to trying to access MMIO in bad ways. The crash further shows perf trying to do a user stack sample while in exit_mmap()'s tlb_finish_mmu() -- i.e. while tearing down the address space it is trying to access. It turns out that we stop perf after we tear down the userspace mm; a receipie for disaster, since perf likes to access userspace for various reasons. Flip this order by moving up where we stop perf in do_exit(). Additionally, harden PERF_SAMPLE_CALLCHAIN and PERF_SAMPLE_STACK_USER to abort when the current task does not have an mm (exit_mm() makes sure to set current->mm = NULL; before commencing with the actual teardown). Such that CPU wide events don't trip on this same problem.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Modified
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 15, 2026
Affected products
Linux Linux linux:linux (from the name) | from c5ebcedb566ef17bda7b02686e0d658a7bb42ee7 before 7b8f3c72175c6a63a95cf2e219f8b78e2baad34e; from c5ebcedb566ef17bda7b02686e0d658a7bb42ee7 before 507c9a595bad3abd107c6a8857d7fd125d89f386; from c5ebcedb566ef17bda7b02686e0d658a7bb42ee7 before a9f6aab7910a0ef2895797f15c947f6d1053160f; from c5ebcedb566ef17bda7b02686e0d658a7bb42ee7 before 975ffddfa2e19823c719459d2364fcaa17673964; from c5ebcedb566ef17bda7b02686e0d658a7bb42ee7 before 2ee6044a693735396bb47eeaba1ac3ae26c1c99b; from c5ebcedb566ef17bda7b02686e0d658a7bb42ee7 before 456019adaa2f5366b89c868dea9b483179bece54; from c5ebcedb566ef17bda7b02686e0d658a7bb42ee7 before 7311970d07c4606362081250da95f2c7901fc0db; from c5ebcedb566ef17bda7b02686e0d658a7bb42ee7 before 4f6fc782128355931527cefe3eb45338abd8ab39 | CNA record |
linux linux_kernel linux:linux_kernel | from 3.7 before 5.4.295; from 5.5 before 5.10.239; from 5.11 before 5.15.186; from 5.16 before 6.1.142; from 6.2 before 6.6.95; from 6.7 before 6.12.35; from 6.13 before 6.15.4; 6.16; and 1 more ranges | NVD |
debian debian_linux debian:debian_linux | 11.0 | NVD |
References
- https://git.kernel.org/stable/c/7b8f3c72175c6a63a95cf2e219f8b78e2baad34epatch
- https://git.kernel.org/stable/c/507c9a595bad3abd107c6a8857d7fd125d89f386patch
- https://git.kernel.org/stable/c/a9f6aab7910a0ef2895797f15c947f6d1053160fpatch
- https://git.kernel.org/stable/c/975ffddfa2e19823c719459d2364fcaa17673964patch
- https://git.kernel.org/stable/c/2ee6044a693735396bb47eeaba1ac3ae26c1c99bpatch
- https://git.kernel.org/stable/c/456019adaa2f5366b89c868dea9b483179bece54patch
- https://git.kernel.org/stable/c/7311970d07c4606362081250da95f2c7901fc0dbpatch
- https://git.kernel.org/stable/c/4f6fc782128355931527cefe3eb45338abd8ab39patch
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.htmlmailing-list, third-party-advisory
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlmailing-list, third-party-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.