CVE-2025-40081 (GCVE-0-2025-40081)

Vulnerability from cvelistv5 – Published: 2025-10-28 11:48 – Updated: 2026-08-05 12:07
VLAI
Title
perf: arm_spe: Prevent overflow in PERF_IDX2OFF()
Summary
In the Linux kernel, the following vulnerability has been resolved: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() Cast nr_pages to unsigned long to avoid overflow when handling large AUX buffer sizes (>= 2 GiB).
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: d5d9696b03808bc6be723cc85288c912c3a05606 , < 656e9a5d69acdd1b20462f4a33378b90ddcb9626 (git)
Affected: d5d9696b03808bc6be723cc85288c912c3a05606 , < 9c045d4501f7f70724a3bbb561f4f22d292bbfe6 (git)
Affected: d5d9696b03808bc6be723cc85288c912c3a05606 , < 5d01f2b81568289443d22f1e13a363f829de6343 (git)
Affected: d5d9696b03808bc6be723cc85288c912c3a05606 , < 7500384d3c9587593d75ded3b006835e7aa73ef8 (git)
Affected: d5d9696b03808bc6be723cc85288c912c3a05606 , < 379cae2cb982f571cda9493ac573ab71125fd299 (git)
Affected: d5d9696b03808bc6be723cc85288c912c3a05606 , < 1a19ba8e1f4ff24ece8ca69b79df8442c431db90 (git)
Affected: d5d9696b03808bc6be723cc85288c912c3a05606 , < e516cfd19b0f4c774a57b17fb43a7f41991f0735 (git)
Affected: d5d9696b03808bc6be723cc85288c912c3a05606 , < a29fea30dd93da16652930162b177941abd8c75e (git)
Create a notification for this product.
Linux Linux Affected: 4.15
Unaffected: 0 , < 4.15 (semver)
Unaffected: 5.4.301 , ≤ 5.4.* (semver)
Unaffected: 5.10.246 , ≤ 5.10.* (semver)
Unaffected: 5.15.195 , ≤ 5.15.* (semver)
Unaffected: 6.1.156 , ≤ 6.1.* (semver)
Unaffected: 6.6.112 , ≤ 6.6.* (semver)
Unaffected: 6.12.53 , ≤ 6.12.* (semver)
Unaffected: 6.17.3 , ≤ 6.17.* (semver)
Unaffected: 6.18 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/perf/arm_spe_pmu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "656e9a5d69acdd1b20462f4a33378b90ddcb9626",
              "status": "affected",
              "version": "d5d9696b03808bc6be723cc85288c912c3a05606",
              "versionType": "git"
            },
            {
              "lessThan": "9c045d4501f7f70724a3bbb561f4f22d292bbfe6",
              "status": "affected",
              "version": "d5d9696b03808bc6be723cc85288c912c3a05606",
              "versionType": "git"
            },
            {
              "lessThan": "5d01f2b81568289443d22f1e13a363f829de6343",
              "status": "affected",
              "version": "d5d9696b03808bc6be723cc85288c912c3a05606",
              "versionType": "git"
            },
            {
              "lessThan": "7500384d3c9587593d75ded3b006835e7aa73ef8",
              "status": "affected",
              "version": "d5d9696b03808bc6be723cc85288c912c3a05606",
              "versionType": "git"
            },
            {
              "lessThan": "379cae2cb982f571cda9493ac573ab71125fd299",
              "status": "affected",
              "version": "d5d9696b03808bc6be723cc85288c912c3a05606",
              "versionType": "git"
            },
            {
              "lessThan": "1a19ba8e1f4ff24ece8ca69b79df8442c431db90",
              "status": "affected",
              "version": "d5d9696b03808bc6be723cc85288c912c3a05606",
              "versionType": "git"
            },
            {
              "lessThan": "e516cfd19b0f4c774a57b17fb43a7f41991f0735",
              "status": "affected",
              "version": "d5d9696b03808bc6be723cc85288c912c3a05606",
              "versionType": "git"
            },
            {
              "lessThan": "a29fea30dd93da16652930162b177941abd8c75e",
              "status": "affected",
              "version": "d5d9696b03808bc6be723cc85288c912c3a05606",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/perf/arm_spe_pmu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.15"
            },
            {
              "lessThan": "4.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.301",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.246",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.195",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.156",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.301",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.246",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.195",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.156",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.112",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.53",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.3",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf: arm_spe: Prevent overflow in PERF_IDX2OFF()\n\nCast nr_pages to unsigned long to avoid overflow when handling large\nAUX buffer sizes (\u003e= 2 GiB)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Triggering requires local syscalls \u2014 perf_event_open() on the arm_spe_0 PMU followed by mmap() of a 2 GiB AUX area and running the profiled workload. There is no remote or adjacent-network path to the SPE driver.\nAC:L - The attacker fully controls every trigger condition: the AUX buffer size is a userspace-chosen power of two (2 GiB is the maximum the allocator permits, and it is exactly the overflow point), and driving rb-\u003eaux_head past 2 GiB is just a matter of letting SPE trace run, which it does at GB/s. No race, no unknowable memory layout, and no rare kernel config \u2014 CONFIG_ARM_SPE_PMU is in arm64 defconfig.\nPR:L - arm_spe_pmu_event_init() performs no capability check on this path, and the driver deliberately uses perf_sw_context so per-task profiling works, bypassing perf_allow_cpu() under the default perf_event_paranoid=2. The only remaining gate on the 2 GiB AUX mapping is RLIMIT_MEMLOCK \u2014 a resource limit, not a privilege \u2014 which is routinely unlimited on the HPC/GPU/RDMA arm64 servers where SPE hardware exists, and is skipped entirely when perf_event_paranoid=-1.\nUI:N - The attacker profiles their own process and generates the trace data themselves; no victim action of any kind is involved.\nS:U - The out-of-bounds writes land in the kernel\u0027s own vmalloc region, within the same security authority as the vulnerable driver. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - PMBPTR_EL1 is programmed with buf-\u003ebase plus an unbounded offset, so the SPE hardware writes profiling records containing kernel/user addresses and data values into arbitrary kernel memory, and the corrupted size passed to perf_aux_output_end() exposes ring-buffer contents at bogus offsets to the userspace mmap. Out-of-bounds memory corruption of this scope is readily leveraged for information disclosure.\nI:H - arm_spe_pmu_pad_buf() memsets an attacker-influenced length starting at buf-\u003ebase + head, far past the end of the 2 GiB vmap region, and the SPE hardware independently writes trace records out of bounds. On arm64 the surrounding vmalloc space contains VMAP_STACKs, module text and BPF JIT images, making this an out-of-bounds write usable for control-flow hijacking.\nA:H - The runaway offset overwhelmingly lands on unmapped vmalloc addresses or vmap guard pages, faulting in kernel context, and the hardware buffer writes raise SPE external aborts that the driver treats as fatal \u2014 either way an oops or panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:07:36.810Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/656e9a5d69acdd1b20462f4a33378b90ddcb9626"
        },
        {
          "url": "https://git.kernel.org/stable/c/9c045d4501f7f70724a3bbb561f4f22d292bbfe6"
        },
        {
          "url": "https://git.kernel.org/stable/c/5d01f2b81568289443d22f1e13a363f829de6343"
        },
        {
          "url": "https://git.kernel.org/stable/c/7500384d3c9587593d75ded3b006835e7aa73ef8"
        },
        {
          "url": "https://git.kernel.org/stable/c/379cae2cb982f571cda9493ac573ab71125fd299"
        },
        {
          "url": "https://git.kernel.org/stable/c/1a19ba8e1f4ff24ece8ca69b79df8442c431db90"
        },
        {
          "url": "https://git.kernel.org/stable/c/e516cfd19b0f4c774a57b17fb43a7f41991f0735"
        },
        {
          "url": "https://git.kernel.org/stable/c/a29fea30dd93da16652930162b177941abd8c75e"
        }
      ],
      "title": "perf: arm_spe: Prevent overflow in PERF_IDX2OFF()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40081",
    "datePublished": "2025-10-28T11:48:45.392Z",
    "dateReserved": "2025-04-16T07:20:57.161Z",
    "dateUpdated": "2026-08-05T12:07:36.810Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-40081",
      "date": "2026-08-05",
      "epss": "0.00144",
      "percentile": "0.0416"
    },
    "microsoft_vex": {
      "current_release_date": "2025-10-29T01:04:15.000Z",
      "cve": "CVE-2025-40081",
      "id": "msrc_CVE-2025-40081",
      "initial_release_date": "2025-10-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "perf: arm_spe: Prevent overflow in PERF_IDX2OFF()",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-40081.json",
      "version": "1"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-40081\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-10-28T12:15:42.717\",\"lastModified\":\"2026-07-30T06:24:10.097\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nperf: arm_spe: Prevent overflow in PERF_IDX2OFF()\\n\\nCast nr_pages to unsigned long to avoid overflow when handling large\\nAUX buffer sizes (\u003e= 2 GiB).\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/perf/arm_spe_pmu.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"d5d9696b03808bc6be723cc85288c912c3a05606\",\"lessThan\":\"656e9a5d69acdd1b20462f4a33378b90ddcb9626\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d5d9696b03808bc6be723cc85288c912c3a05606\",\"lessThan\":\"9c045d4501f7f70724a3bbb561f4f22d292bbfe6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d5d9696b03808bc6be723cc85288c912c3a05606\",\"lessThan\":\"5d01f2b81568289443d22f1e13a363f829de6343\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d5d9696b03808bc6be723cc85288c912c3a05606\",\"lessThan\":\"7500384d3c9587593d75ded3b006835e7aa73ef8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d5d9696b03808bc6be723cc85288c912c3a05606\",\"lessThan\":\"379cae2cb982f571cda9493ac573ab71125fd299\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d5d9696b03808bc6be723cc85288c912c3a05606\",\"lessThan\":\"1a19ba8e1f4ff24ece8ca69b79df8442c431db90\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d5d9696b03808bc6be723cc85288c912c3a05606\",\"lessThan\":\"e516cfd19b0f4c774a57b17fb43a7f41991f0735\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d5d9696b03808bc6be723cc85288c912c3a05606\",\"lessThan\":\"a29fea30dd93da16652930162b177941abd8c75e\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/perf/arm_spe_pmu.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.15\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.15\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.301\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.246\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.195\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.156\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.112\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.53\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17.3\",\"lessThanOrEqual\":\"6.17.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1a19ba8e1f4ff24ece8ca69b79df8442c431db90\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/379cae2cb982f571cda9493ac573ab71125fd299\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5d01f2b81568289443d22f1e13a363f829de6343\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/656e9a5d69acdd1b20462f4a33378b90ddcb9626\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7500384d3c9587593d75ded3b006835e7aa73ef8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9c045d4501f7f70724a3bbb561f4f22d292bbfe6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a29fea30dd93da16652930162b177941abd8c75e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e516cfd19b0f4c774a57b17fb43a7f41991f0735\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T08:52:36+00:00",
      "cve": "CVE-2025-40081",
      "id": "CVE-2025-40081",
      "initial_release_date": "2025-10-28T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: perf: arm_spe: Prevent overflow in PERF_IDX2OFF()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-40081.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.