FKIE_CVE-2025-39821

Vulnerability from fkie_nvd - Published: 2025-09-16 13:15 - Updated: 2026-10-19 21:10
Severity
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: perf: Avoid undefined behavior from stopping/starting inactive events Calling pmu->start()/stop() on perf events in PERF_EVENT_STATE_OFF can leave event->hw.idx at -1. When PMU drivers later attempt to use this negative index as a shift exponent in bitwise operations, it leads to UBSAN shift-out-of-bounds reports. The issue is a logical flaw in how event groups handle throttling when some members are intentionally disabled. Based on the analysis and the reproducer provided by Mark Rutland (this issue on both arm64 and x86-64). The scenario unfolds as follows: 1. A group leader event is configured with a very aggressive sampling period (e.g., sample_period = 1). This causes frequent interrupts and triggers the throttling mechanism. 2. A child event in the same group is created in a disabled state (.disabled = 1). This event remains in PERF_EVENT_STATE_OFF. Since it hasn't been scheduled onto the PMU, its event->hw.idx remains initialized at -1. 3. When throttling occurs, perf_event_throttle_group() and later perf_event_unthrottle_group() iterate through all siblings, including the disabled child event. 4. perf_event_throttle()/unthrottle() are called on this inactive child event, which then call event->pmu->start()/stop(). 5. The PMU driver receives the event with hw.idx == -1 and attempts to use it as a shift exponent. e.g., in macros like PMCNTENSET(idx), leading to the UBSAN report. The throttling mechanism attempts to start/stop events that are not actively scheduled on the hardware. Move the state check into perf_event_throttle()/perf_event_unthrottle() so that inactive events are skipped entirely. This ensures only active events with a valid hw.idx are processed, preventing undefined behavior and silencing UBSAN warnings. The corrected check ensures true before proceeding with PMU operations. The problem can be reproduced with the syzkaller reproducer:
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/b64fdd422a85025b5e91ead794db9d3ef970e369Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/d689135aa9c5e4e0eab5a92bbe35dab0c8d6677fPatch
Impacted products
Vendor Product Version
linux linux_kernel *
linux linux_kernel 6.17
linux linux_kernel 6.17
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/events/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d689135aa9c5e4e0eab5a92bbe35dab0c8d6677f",
              "status": "affected",
              "version": "9734e25fbf5ae68eb04234b2cd14a4b36ab89141",
              "versionType": "git"
            },
            {
              "lessThan": "b64fdd422a85025b5e91ead794db9d3ef970e369",
              "status": "affected",
              "version": "9734e25fbf5ae68eb04234b2cd14a4b36ab89141",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/events/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "lessThan": "6.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "5EAC2366-3E84-4F52-AF72-DB8127DB7367",
              "versionEndExcluding": "6.16.5",
              "versionStartIncluding": "6.16",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "327D22EF-390B-454C-BD31-2ED23C998A1C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "C730CD9A-D969-4A8E-9522-162AAF7C0EE9",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf: Avoid undefined behavior from stopping/starting inactive events\n\nCalling pmu-\u003estart()/stop() on perf events in PERF_EVENT_STATE_OFF can\nleave event-\u003ehw.idx at -1. When PMU drivers later attempt to use this\nnegative index as a shift exponent in bitwise operations, it leads to UBSAN\nshift-out-of-bounds reports.\n\nThe issue is a logical flaw in how event groups handle throttling when some\nmembers are intentionally disabled. Based on the analysis and the\nreproducer provided by Mark Rutland (this issue on both arm64 and x86-64).\n\nThe scenario unfolds as follows:\n\n 1. A group leader event is configured with a very aggressive sampling\n    period (e.g., sample_period = 1). This causes frequent interrupts and\n    triggers the throttling mechanism.\n 2. A child event in the same group is created in a disabled state\n    (.disabled = 1). This event remains in PERF_EVENT_STATE_OFF.\n    Since it hasn\u0027t been scheduled onto the PMU, its event-\u003ehw.idx remains\n    initialized at -1.\n 3. When throttling occurs, perf_event_throttle_group() and later\n    perf_event_unthrottle_group() iterate through all siblings, including\n    the disabled child event.\n 4. perf_event_throttle()/unthrottle() are called on this inactive child\n    event, which then call event-\u003epmu-\u003estart()/stop().\n 5. The PMU driver receives the event with hw.idx == -1 and attempts to\n    use it as a shift exponent. e.g., in macros like PMCNTENSET(idx),\n    leading to the UBSAN report.\n\nThe throttling mechanism attempts to start/stop events that are not\nactively scheduled on the hardware.\n\nMove the state check into perf_event_throttle()/perf_event_unthrottle() so\nthat inactive events are skipped entirely. This ensures only active events\nwith a valid hw.idx are processed, preventing undefined behavior and\nsilencing UBSAN warnings. The corrected check ensures true before\nproceeding with PMU operations.\n\nThe problem can be reproduced with the syzkaller reproducer:"
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nperf: Evitar comportamiento indefinido al detener/iniciar eventos inactivos\n\nLlamar a pmu-\u003estart()/stop() en eventos perf en PERF_EVENT_STATE_OFF puede dejar event-\u003ehw.idx en -1. Cuando los controladores de PMU intentan m\u00e1s tarde usar este \u00edndice negativo como un exponente de desplazamiento en operaciones bit a bit, esto lleva a informes de UBSAN de desplazamiento fuera de l\u00edmites.\n\nEl problema es un fallo l\u00f3gico en c\u00f3mo los grupos de eventos manejan la limitaci\u00f3n cuando algunos miembros est\u00e1n deshabilitados intencionalmente. Basado en el an\u00e1lisis y el reproductor proporcionado por Mark Rutland (este problema tanto en arm64 como en x86-64).\n\nEl escenario se desarrolla de la siguiente manera:\n\n1. Un evento l\u00edder de grupo se configura con un per\u00edodo de muestreo muy agresivo (por ejemplo, sample_period = 1). Esto causa interrupciones frecuentes y activa el mecanismo de limitaci\u00f3n.\n2. Se crea un evento hijo en el mismo grupo en un estado deshabilitado (.disabled = 1). Este evento permanece en PERF_EVENT_STATE_OFF. Dado que no ha sido programado en la PMU, su event-\u003ehw.idx permanece inicializado en -1.\n3. Cuando ocurre la limitaci\u00f3n, perf_event_throttle_group() y m\u00e1s tarde perf_event_unthrottle_group() iteran a trav\u00e9s de todos los hermanos, incluyendo el evento hijo deshabilitado.\n4. Se llama a perf_event_throttle()/unthrottle() en este evento hijo inactivo, que luego llaman a event-\u003epmu-\u003estart()/stop().\n5. El controlador de PMU recibe el evento con hw.idx == -1 e intenta usarlo como un exponente de desplazamiento. Por ejemplo, en macros como PMCNTENSET(idx), lo que lleva al informe de UBSAN.\n\nEl mecanismo de limitaci\u00f3n intenta iniciar/detener eventos que no est\u00e1n programados activamente en el hardware.\n\nMover la verificaci\u00f3n de estado a perf_event_throttle()/perf_event_unthrottle() para que los eventos inactivos se omitan por completo. Esto asegura que solo los eventos activos con un hw.idx v\u00e1lido sean procesados, previniendo comportamiento indefinido y silenciando las advertencias de UBSAN. La verificaci\u00f3n corregida asegura verdadero antes de proceder con las operaciones de PMU.\n\nEl problema puede ser reproducido con el reproductor de syzkaller:"
    }
  ],
  "id": "CVE-2025-39821",
  "lastModified": "2026-10-19T21:10:00.160",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-39821",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-01-14T18:16:47.835074Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-09-16T13:15:59.300",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/b64fdd422a85025b5e91ead794db9d3ef970e369"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/d689135aa9c5e4e0eab5a92bbe35dab0c8d6677f"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.