GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-68375 (GCVE-0-2025-68375)

Vulnerability from cvelistv5 – Published: 2025-12-24 10:33 – Updated: 2026-05-11 21:51
VLAI
Title
perf/x86: Fix NULL event access and potential PEBS record loss
Summary
In the Linux kernel, the following vulnerability has been resolved: perf/x86: Fix NULL event access and potential PEBS record loss When intel_pmu_drain_pebs_icl() is called to drain PEBS records, the perf_event_overflow() could be called to process the last PEBS record. While perf_event_overflow() could trigger the interrupt throttle and stop all events of the group, like what the below call-chain shows. perf_event_overflow() -> __perf_event_overflow() ->__perf_event_account_interrupt() -> perf_event_throttle_group() -> perf_event_throttle() -> event->pmu->stop() -> x86_pmu_stop() The side effect of stopping the events is that all corresponding event pointers in cpuc->events[] array are cleared to NULL. Assume there are two PEBS events (event a and event b) in a group. When intel_pmu_drain_pebs_icl() calls perf_event_overflow() to process the last PEBS record of PEBS event a, interrupt throttle is triggered and all pointers of event a and event b are cleared to NULL. Then intel_pmu_drain_pebs_icl() tries to process the last PEBS record of event b and encounters NULL pointer access. To avoid this issue, move cpuc->events[] clearing from x86_pmu_stop() to x86_pmu_del(). It's safe since cpuc->active_mask or cpuc->pebs_enabled is always checked before access the event pointer from cpuc->events[].
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 9734e25fbf5ae68eb04234b2cd14a4b36ab89141 , < cf69b99805c263117305ac6dffbc85aaf9259d32 (git)
Affected: 9734e25fbf5ae68eb04234b2cd14a4b36ab89141 , < 6b089028bff1f2ff9e0c62b8f1faca1a620e5d6e (git)
Affected: 9734e25fbf5ae68eb04234b2cd14a4b36ab89141 , < 7e772a93eb61cb6265bdd1c5bde17d0f2718b452 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.16
Unaffected: 0 , < 6.16 (semver)
Unaffected: 6.17.13 , ≤ 6.17.* (semver)
Unaffected: 6.18.2 , ≤ 6.18.* (semver)
Unaffected: 6.19 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/events/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cf69b99805c263117305ac6dffbc85aaf9259d32",
              "status": "affected",
              "version": "9734e25fbf5ae68eb04234b2cd14a4b36ab89141",
              "versionType": "git"
            },
            {
              "lessThan": "6b089028bff1f2ff9e0c62b8f1faca1a620e5d6e",
              "status": "affected",
              "version": "9734e25fbf5ae68eb04234b2cd14a4b36ab89141",
              "versionType": "git"
            },
            {
              "lessThan": "7e772a93eb61cb6265bdd1c5bde17d0f2718b452",
              "status": "affected",
              "version": "9734e25fbf5ae68eb04234b2cd14a4b36ab89141",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/events/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "lessThan": "6.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.13",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.2",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf/x86: Fix NULL event access and potential PEBS record loss\n\nWhen intel_pmu_drain_pebs_icl() is called to drain PEBS records, the\nperf_event_overflow() could be called to process the last PEBS record.\n\nWhile perf_event_overflow() could trigger the interrupt throttle and\nstop all events of the group, like what the below call-chain shows.\n\nperf_event_overflow()\n  -\u003e __perf_event_overflow()\n    -\u003e__perf_event_account_interrupt()\n      -\u003e perf_event_throttle_group()\n        -\u003e perf_event_throttle()\n          -\u003e event-\u003epmu-\u003estop()\n            -\u003e x86_pmu_stop()\n\nThe side effect of stopping the events is that all corresponding event\npointers in cpuc-\u003eevents[] array are cleared to NULL.\n\nAssume there are two PEBS events (event a and event b) in a group. When\nintel_pmu_drain_pebs_icl() calls perf_event_overflow() to process the\nlast PEBS record of PEBS event a, interrupt throttle is triggered and\nall pointers of event a and event b are cleared to NULL. Then\nintel_pmu_drain_pebs_icl() tries to process the last PEBS record of\nevent b and encounters NULL pointer access.\n\nTo avoid this issue, move cpuc-\u003eevents[] clearing from x86_pmu_stop()\nto x86_pmu_del(). It\u0027s safe since cpuc-\u003eactive_mask or\ncpuc-\u003epebs_enabled is always checked before access the event pointer\nfrom cpuc-\u003eevents[]."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:51:59.533Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cf69b99805c263117305ac6dffbc85aaf9259d32"
        },
        {
          "url": "https://git.kernel.org/stable/c/6b089028bff1f2ff9e0c62b8f1faca1a620e5d6e"
        },
        {
          "url": "https://git.kernel.org/stable/c/7e772a93eb61cb6265bdd1c5bde17d0f2718b452"
        }
      ],
      "title": "perf/x86: Fix NULL event access and potential PEBS record loss",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-68375",
    "datePublished": "2025-12-24T10:33:04.819Z",
    "dateReserved": "2025-12-16T14:48:05.310Z",
    "dateUpdated": "2026-05-11T21:51:59.533Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-68375",
      "date": "2026-09-16",
      "epss": "0.00188",
      "percentile": "0.08675"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-68375\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-24T11:16:01.097\",\"lastModified\":\"2026-06-17T09:59:01.483\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nperf/x86: Fix NULL event access and potential PEBS record loss\\n\\nWhen intel_pmu_drain_pebs_icl() is called to drain PEBS records, the\\nperf_event_overflow() could be called to process the last PEBS record.\\n\\nWhile perf_event_overflow() could trigger the interrupt throttle and\\nstop all events of the group, like what the below call-chain shows.\\n\\nperf_event_overflow()\\n  -\u003e __perf_event_overflow()\\n    -\u003e__perf_event_account_interrupt()\\n      -\u003e perf_event_throttle_group()\\n        -\u003e perf_event_throttle()\\n          -\u003e event-\u003epmu-\u003estop()\\n            -\u003e x86_pmu_stop()\\n\\nThe side effect of stopping the events is that all corresponding event\\npointers in cpuc-\u003eevents[] array are cleared to NULL.\\n\\nAssume there are two PEBS events (event a and event b) in a group. When\\nintel_pmu_drain_pebs_icl() calls perf_event_overflow() to process the\\nlast PEBS record of PEBS event a, interrupt throttle is triggered and\\nall pointers of event a and event b are cleared to NULL. Then\\nintel_pmu_drain_pebs_icl() tries to process the last PEBS record of\\nevent b and encounters NULL pointer access.\\n\\nTo avoid this issue, move cpuc-\u003eevents[] clearing from x86_pmu_stop()\\nto x86_pmu_del(). It\u0027s safe since cpuc-\u003eactive_mask or\\ncpuc-\u003epebs_enabled is always checked before access the event pointer\\nfrom cpuc-\u003eevents[].\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"arch/x86/events/core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"9734e25fbf5ae68eb04234b2cd14a4b36ab89141\",\"lessThan\":\"cf69b99805c263117305ac6dffbc85aaf9259d32\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9734e25fbf5ae68eb04234b2cd14a4b36ab89141\",\"lessThan\":\"6b089028bff1f2ff9e0c62b8f1faca1a620e5d6e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9734e25fbf5ae68eb04234b2cd14a4b36ab89141\",\"lessThan\":\"7e772a93eb61cb6265bdd1c5bde17d0f2718b452\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"arch/x86/events/core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.16\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.16\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17.13\",\"lessThanOrEqual\":\"6.17.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.2\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/6b089028bff1f2ff9e0c62b8f1faca1a620e5d6e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7e772a93eb61cb6265bdd1c5bde17d0f2718b452\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/cf69b99805c263117305ac6dffbc85aaf9259d32\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-06-30T10:32:21+00:00",
      "cve": "CVE-2025-68375",
      "id": "CVE-2025-68375",
      "initial_release_date": "2025-12-24T00:00:00+00:00",
      "product_status:known_affected": "76",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel: Denial of Service due to null pointer dereference in perf/x86 PEBS processing",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-68375.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.