CVE-2025-39821 (GCVE-0-2025-39821)

Vulnerability from cvelistv5 – Published: 2025-09-16 13:00 – Updated: 2026-08-05 12:05
VLAI
Title
perf: Avoid undefined behavior from stopping/starting inactive events
Summary
In the Linux kernel, the following vulnerability has been resolved: perf: Avoid undefined behavior from stopping/starting inactive events Calling pmu->start()/stop() on perf events in PERF_EVENT_STATE_OFF can leave event->hw.idx at -1. When PMU drivers later attempt to use this negative index as a shift exponent in bitwise operations, it leads to UBSAN shift-out-of-bounds reports. The issue is a logical flaw in how event groups handle throttling when some members are intentionally disabled. Based on the analysis and the reproducer provided by Mark Rutland (this issue on both arm64 and x86-64). The scenario unfolds as follows: 1. A group leader event is configured with a very aggressive sampling period (e.g., sample_period = 1). This causes frequent interrupts and triggers the throttling mechanism. 2. A child event in the same group is created in a disabled state (.disabled = 1). This event remains in PERF_EVENT_STATE_OFF. Since it hasn't been scheduled onto the PMU, its event->hw.idx remains initialized at -1. 3. When throttling occurs, perf_event_throttle_group() and later perf_event_unthrottle_group() iterate through all siblings, including the disabled child event. 4. perf_event_throttle()/unthrottle() are called on this inactive child event, which then call event->pmu->start()/stop(). 5. The PMU driver receives the event with hw.idx == -1 and attempts to use it as a shift exponent. e.g., in macros like PMCNTENSET(idx), leading to the UBSAN report. The throttling mechanism attempts to start/stop events that are not actively scheduled on the hardware. Move the state check into perf_event_throttle()/perf_event_unthrottle() so that inactive events are skipped entirely. This ensures only active events with a valid hw.idx are processed, preventing undefined behavior and silencing UBSAN warnings. The corrected check ensures true before proceeding with PMU operations. The problem can be reproduced with the syzkaller reproducer:
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 9734e25fbf5ae68eb04234b2cd14a4b36ab89141 , < d689135aa9c5e4e0eab5a92bbe35dab0c8d6677f (git)
Affected: 9734e25fbf5ae68eb04234b2cd14a4b36ab89141 , < b64fdd422a85025b5e91ead794db9d3ef970e369 (git)
Create a notification for this product.
Linux Linux Affected: 6.16
Unaffected: 0 , < 6.16 (semver)
Unaffected: 6.16.5 , ≤ 6.16.* (semver)
Unaffected: 6.17 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-39821",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-14T18:16:47.835074Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-787",
                "description": "CWE-787 Out-of-bounds Write",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-14T18:22:56.192Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/events/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d689135aa9c5e4e0eab5a92bbe35dab0c8d6677f",
              "status": "affected",
              "version": "9734e25fbf5ae68eb04234b2cd14a4b36ab89141",
              "versionType": "git"
            },
            {
              "lessThan": "b64fdd422a85025b5e91ead794db9d3ef970e369",
              "status": "affected",
              "version": "9734e25fbf5ae68eb04234b2cd14a4b36ab89141",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/events/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "lessThan": "6.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.5",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf: Avoid undefined behavior from stopping/starting inactive events\n\nCalling pmu-\u003estart()/stop() on perf events in PERF_EVENT_STATE_OFF can\nleave event-\u003ehw.idx at -1. When PMU drivers later attempt to use this\nnegative index as a shift exponent in bitwise operations, it leads to UBSAN\nshift-out-of-bounds reports.\n\nThe issue is a logical flaw in how event groups handle throttling when some\nmembers are intentionally disabled. Based on the analysis and the\nreproducer provided by Mark Rutland (this issue on both arm64 and x86-64).\n\nThe scenario unfolds as follows:\n\n 1. A group leader event is configured with a very aggressive sampling\n    period (e.g., sample_period = 1). This causes frequent interrupts and\n    triggers the throttling mechanism.\n 2. A child event in the same group is created in a disabled state\n    (.disabled = 1). This event remains in PERF_EVENT_STATE_OFF.\n    Since it hasn\u0027t been scheduled onto the PMU, its event-\u003ehw.idx remains\n    initialized at -1.\n 3. When throttling occurs, perf_event_throttle_group() and later\n    perf_event_unthrottle_group() iterate through all siblings, including\n    the disabled child event.\n 4. perf_event_throttle()/unthrottle() are called on this inactive child\n    event, which then call event-\u003epmu-\u003estart()/stop().\n 5. The PMU driver receives the event with hw.idx == -1 and attempts to\n    use it as a shift exponent. e.g., in macros like PMCNTENSET(idx),\n    leading to the UBSAN report.\n\nThe throttling mechanism attempts to start/stop events that are not\nactively scheduled on the hardware.\n\nMove the state check into perf_event_throttle()/perf_event_unthrottle() so\nthat inactive events are skipped entirely. This ensures only active events\nwith a valid hw.idx are processed, preventing undefined behavior and\nsilencing UBSAN warnings. The corrected check ensures true before\nproceeding with PMU operations.\n\nThe problem can be reproduced with the syzkaller reproducer:"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached exclusively through the `perf_event_open(2)` syscall and `ioctl(PERF_EVENT_IOC_PERIOD)` on the resulting fd; there is no network or remote-peer input path into the perf throttling code.\nAC:L - The attacker fully controls both halves \u2014 the group leader\u0027s `sample_period=1` deterministically forces throttling within milliseconds, and the disabled sibling is created by the attacker; there is no race or memory-layout condition outside their influence, and the UAF window length is itself chosen via the sibling\u0027s `sample_period`.\nPR:L - At the mainline default `kernel.perf_event_paranoid=2`, an unprivileged local user can open a task-scoped sampling group with `exclude_kernel=1` and no capabilities (`perf_allow_kernel()` is only invoked for `!exclude_kernel`), and software cpu-clock/task-clock events need no hardware PMU, so the bug is reachable from containers and VMs.\nUI:N - The attacking process performs the entire sequence \u2014 create group, force throttle, wait for unthrottle, close the fds \u2014 with no action by any other user or victim process.\nS:U - The corruption is confined to kernel memory and PMU state within the same security authority; no hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - A `perf_event` is freed while its embedded `hw.hrtimer` remains enqueued on the per-CPU hrtimer base, giving a use-after-free over an attacker-timed window that can be reclaimed and read back through the timer machinery; the x86 path additionally performs an out-of-bounds `bt` read below `cpuc-\u003eactive_mask`.\nI:H - The dangling hrtimer means `__run_hrtimer()` calls `timer-\u003efunction` from reclaimed heap memory, a direct control-flow hijack primitive after a heap spray; the x86 `btr` at bit offset -1 is also an out-of-bounds bit write into the adjacent per-CPU `cpu_hw_events` pointer.\nA:H - Even without exploitation the bug reliably produces kernel oopses from the freed-timer dereference, and the arm64 path hits a non-`_ONCE` `WARN(1, \"Invalid PMEV* index\")` plus a UBSAN shift-out-of-bounds report on every trigger \u2014 an unprivileged panic under `panic_on_warn`/`ubsan_panic` and log flooding otherwise."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:05:25.973Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d689135aa9c5e4e0eab5a92bbe35dab0c8d6677f"
        },
        {
          "url": "https://git.kernel.org/stable/c/b64fdd422a85025b5e91ead794db9d3ef970e369"
        }
      ],
      "title": "perf: Avoid undefined behavior from stopping/starting inactive events",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39821",
    "datePublished": "2025-09-16T13:00:20.805Z",
    "dateReserved": "2025-04-16T07:20:57.139Z",
    "dateUpdated": "2026-08-05T12:05:25.973Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-39821",
      "date": "2026-08-05",
      "epss": "0.00148",
      "percentile": "0.04496"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-39821\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-09-16T13:15:59.300\",\"lastModified\":\"2026-06-17T09:18:33.207\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nperf: Avoid undefined behavior from stopping/starting inactive events\\n\\nCalling pmu-\u003estart()/stop() on perf events in PERF_EVENT_STATE_OFF can\\nleave event-\u003ehw.idx at -1. When PMU drivers later attempt to use this\\nnegative index as a shift exponent in bitwise operations, it leads to UBSAN\\nshift-out-of-bounds reports.\\n\\nThe issue is a logical flaw in how event groups handle throttling when some\\nmembers are intentionally disabled. Based on the analysis and the\\nreproducer provided by Mark Rutland (this issue on both arm64 and x86-64).\\n\\nThe scenario unfolds as follows:\\n\\n 1. A group leader event is configured with a very aggressive sampling\\n    period (e.g., sample_period = 1). This causes frequent interrupts and\\n    triggers the throttling mechanism.\\n 2. A child event in the same group is created in a disabled state\\n    (.disabled = 1). This event remains in PERF_EVENT_STATE_OFF.\\n    Since it hasn\u0027t been scheduled onto the PMU, its event-\u003ehw.idx remains\\n    initialized at -1.\\n 3. When throttling occurs, perf_event_throttle_group() and later\\n    perf_event_unthrottle_group() iterate through all siblings, including\\n    the disabled child event.\\n 4. perf_event_throttle()/unthrottle() are called on this inactive child\\n    event, which then call event-\u003epmu-\u003estart()/stop().\\n 5. The PMU driver receives the event with hw.idx == -1 and attempts to\\n    use it as a shift exponent. e.g., in macros like PMCNTENSET(idx),\\n    leading to the UBSAN report.\\n\\nThe throttling mechanism attempts to start/stop events that are not\\nactively scheduled on the hardware.\\n\\nMove the state check into perf_event_throttle()/perf_event_unthrottle() so\\nthat inactive events are skipped entirely. This ensures only active events\\nwith a valid hw.idx are processed, preventing undefined behavior and\\nsilencing UBSAN warnings. The corrected check ensures true before\\nproceeding with PMU operations.\\n\\nThe problem can be reproduced with the syzkaller reproducer:\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"kernel/events/core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"9734e25fbf5ae68eb04234b2cd14a4b36ab89141\",\"lessThan\":\"d689135aa9c5e4e0eab5a92bbe35dab0c8d6677f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9734e25fbf5ae68eb04234b2cd14a4b36ab89141\",\"lessThan\":\"b64fdd422a85025b5e91ead794db9d3ef970e369\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"kernel/events/core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.16\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.16\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16.5\",\"lessThanOrEqual\":\"6.16.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-01-14T18:16:47.835074Z\",\"id\":\"CVE-2025-39821\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.16\",\"versionEndExcluding\":\"6.16.5\",\"matchCriteriaId\":\"5EAC2366-3E84-4F52-AF72-DB8127DB7367\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"327D22EF-390B-454C-BD31-2ED23C998A1C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"C730CD9A-D969-4A8E-9522-162AAF7C0EE9\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/b64fdd422a85025b5e91ead794db9d3ef970e369\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d689135aa9c5e4e0eab5a92bbe35dab0c8d6677f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-30T01:20:47+00:00",
      "cve": "CVE-2025-39821",
      "id": "CVE-2025-39821",
      "initial_release_date": "2025-09-16T00:00:00+00:00",
      "product_status:known_affected": "14",
      "product_status:known_not_affected": "260",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: perf: Avoid undefined behavior from stopping/starting inactive events",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-39821.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-39821\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-01-14T18:16:47.835074Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-787\", \"description\": \"CWE-787 Out-of-bounds Write\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-01-14T18:16:43.273Z\"}}], \"cna\": {\"title\": \"perf: Avoid undefined behavior from stopping/starting inactive events\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"9734e25fbf5ae68eb04234b2cd14a4b36ab89141\", \"lessThan\": \"d689135aa9c5e4e0eab5a92bbe35dab0c8d6677f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9734e25fbf5ae68eb04234b2cd14a4b36ab89141\", \"lessThan\": \"b64fdd422a85025b5e91ead794db9d3ef970e369\", \"versionType\": \"git\"}], \"programFiles\": [\"kernel/events/core.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.16\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.16\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.16.5\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.16.*\"}, {\"status\": \"unaffected\", \"version\": \"6.17\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"kernel/events/core.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/d689135aa9c5e4e0eab5a92bbe35dab0c8d6677f\"}, {\"url\": \"https://git.kernel.org/stable/c/b64fdd422a85025b5e91ead794db9d3ef970e369\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nperf: Avoid undefined behavior from stopping/starting inactive events\\n\\nCalling pmu-\u003estart()/stop() on perf events in PERF_EVENT_STATE_OFF can\\nleave event-\u003ehw.idx at -1. When PMU drivers later attempt to use this\\nnegative index as a shift exponent in bitwise operations, it leads to UBSAN\\nshift-out-of-bounds reports.\\n\\nThe issue is a logical flaw in how event groups handle throttling when some\\nmembers are intentionally disabled. Based on the analysis and the\\nreproducer provided by Mark Rutland (this issue on both arm64 and x86-64).\\n\\nThe scenario unfolds as follows:\\n\\n 1. A group leader event is configured with a very aggressive sampling\\n    period (e.g., sample_period = 1). This causes frequent interrupts and\\n    triggers the throttling mechanism.\\n 2. A child event in the same group is created in a disabled state\\n    (.disabled = 1). This event remains in PERF_EVENT_STATE_OFF.\\n    Since it hasn\u0027t been scheduled onto the PMU, its event-\u003ehw.idx remains\\n    initialized at -1.\\n 3. When throttling occurs, perf_event_throttle_group() and later\\n    perf_event_unthrottle_group() iterate through all siblings, including\\n    the disabled child event.\\n 4. perf_event_throttle()/unthrottle() are called on this inactive child\\n    event, which then call event-\u003epmu-\u003estart()/stop().\\n 5. The PMU driver receives the event with hw.idx == -1 and attempts to\\n    use it as a shift exponent. e.g., in macros like PMCNTENSET(idx),\\n    leading to the UBSAN report.\\n\\nThe throttling mechanism attempts to start/stop events that are not\\nactively scheduled on the hardware.\\n\\nMove the state check into perf_event_throttle()/perf_event_unthrottle() so\\nthat inactive events are skipped entirely. This ensures only active events\\nwith a valid hw.idx are processed, preventing undefined behavior and\\nsilencing UBSAN warnings. The corrected check ensures true before\\nproceeding with PMU operations.\\n\\nThe problem can be reproduced with the syzkaller reproducer:\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.16.5\", \"versionStartIncluding\": \"6.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.17\", \"versionStartIncluding\": \"6.16\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-07-30T05:57:50.530Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-39821\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-30T05:57:50.530Z\", \"dateReserved\": \"2025-04-16T07:20:57.139Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-09-16T13:00:20.805Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.