GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-22094 (GCVE-0-2025-22094)

Vulnerability from cvelistv5 – Published: 2025-04-16 14:12 – Updated: 2026-08-05 11:56
VLAI
Title
powerpc/perf: Fix ref-counting on the PMU 'vpa_pmu'
Summary
In the Linux kernel, the following vulnerability has been resolved: powerpc/perf: Fix ref-counting on the PMU 'vpa_pmu' Commit 176cda0619b6 ("powerpc/perf: Add perf interface to expose vpa counters") introduced 'vpa_pmu' to expose Book3s-HV nested APIv2 provided L1<->L2 context switch latency counters to L1 user-space via perf-events. However the newly introduced PMU named 'vpa_pmu' doesn't assign ownership of the PMU to the module 'vpa_pmu'. Consequently the module 'vpa_pmu' can be unloaded while one of the perf-events are still active, which can lead to kernel oops and panic of the form below on a Pseries-LPAR: BUG: Kernel NULL pointer dereference on read at 0x00000058 <snip> NIP [c000000000506cb8] event_sched_out+0x40/0x258 LR [c00000000050e8a4] __perf_remove_from_context+0x7c/0x2b0 Call Trace: [c00000025fc3fc30] [c00000025f8457a8] 0xc00000025f8457a8 (unreliable) [c00000025fc3fc80] [fffffffffffffee0] 0xfffffffffffffee0 [c00000025fc3fcd0] [c000000000501e70] event_function+0xa8/0x120 <snip> Kernel panic - not syncing: Aiee, killing interrupt handler! Fix this by adding the module ownership to 'vpa_pmu' so that the module 'vpa_pmu' is ref-counted and prevented from being unloaded when perf-events are initialized.
Severity
7.3 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 176cda0619b6c17a553625f6e2fcbc3981ad667d , < 70ea7c5189197c6f5acdcfd8a2651be2c41e2faa (git)
Affected: 176cda0619b6c17a553625f6e2fcbc3981ad667d , < 6cf045b51e2c5721db7e55305f09ee32741e00f9 (git)
Affected: 176cda0619b6c17a553625f6e2fcbc3981ad667d , < ff99d5b6a246715f2257123cdf6c4a29cb33aa78 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.13
Unaffected: 0 , < 6.13 (semver)
Unaffected: 6.13.11 , ≤ 6.13.* (semver)
Unaffected: 6.14.2 , ≤ 6.14.* (semver)
Unaffected: 6.15 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/powerpc/perf/vpa-pmu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "70ea7c5189197c6f5acdcfd8a2651be2c41e2faa",
              "status": "affected",
              "version": "176cda0619b6c17a553625f6e2fcbc3981ad667d",
              "versionType": "git"
            },
            {
              "lessThan": "6cf045b51e2c5721db7e55305f09ee32741e00f9",
              "status": "affected",
              "version": "176cda0619b6c17a553625f6e2fcbc3981ad667d",
              "versionType": "git"
            },
            {
              "lessThan": "ff99d5b6a246715f2257123cdf6c4a29cb33aa78",
              "status": "affected",
              "version": "176cda0619b6c17a553625f6e2fcbc3981ad667d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/powerpc/perf/vpa-pmu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.13"
            },
            {
              "lessThan": "6.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.11",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.2",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/perf: Fix ref-counting on the PMU \u0027vpa_pmu\u0027\n\nCommit 176cda0619b6 (\"powerpc/perf: Add perf interface to expose vpa\ncounters\") introduced \u0027vpa_pmu\u0027 to expose Book3s-HV nested APIv2 provided\nL1\u003c-\u003eL2 context switch latency counters to L1 user-space via\nperf-events. However the newly introduced PMU named \u0027vpa_pmu\u0027 doesn\u0027t\nassign ownership of the PMU to the module \u0027vpa_pmu\u0027. Consequently the\nmodule \u0027vpa_pmu\u0027 can be unloaded while one of the perf-events are still\nactive, which can lead to kernel oops and panic of the form below on a\nPseries-LPAR:\n\nBUG: Kernel NULL pointer dereference on read at 0x00000058\n\u003csnip\u003e\n NIP [c000000000506cb8] event_sched_out+0x40/0x258\n LR [c00000000050e8a4] __perf_remove_from_context+0x7c/0x2b0\n Call Trace:\n [c00000025fc3fc30] [c00000025f8457a8] 0xc00000025f8457a8 (unreliable)\n [c00000025fc3fc80] [fffffffffffffee0] 0xfffffffffffffee0\n [c00000025fc3fcd0] [c000000000501e70] event_function+0xa8/0x120\n\u003csnip\u003e\n Kernel panic - not syncing: Aiee, killing interrupt handler!\n\nFix this by adding the module ownership to \u0027vpa_pmu\u0027 so that the module\n\u0027vpa_pmu\u0027 is ref-counted and prevented from being unloaded when perf-events\nare initialized."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached entirely through local syscalls \u2014 `perf_event_open(2)` to bind an event to the `vpa_pmu` PMU and `delete_module(2)` to unload the module. There is no network or remote-peer input path to this powerpc perf driver.\nAC:L - The attacker deterministically sets up the condition by holding a `vpa_pmu` perf event open indefinitely; there is no race to win and no memory layout beyond the attacker\u0027s influence, so any subsequent module unload reliably hits a live dangling event.\nPR:L - The missing module reference is taken (or rather, not taken) on behalf of an ordinary local user calling `perf_event_open` \u2014 no capability is checked in `vpa_pmu_event_init()`, and the `perf_allow_kernel()` gate is open to unprivileged users whenever `kernel.perf_event_paranoid \u003c= 1`, a routine setting on the profiling/KVM-on-PowerVM hosts where this PMU is deployed.\nUI:R - Triggering the use-after-free requires the module to actually be unloaded, and `delete_module(2)` demands `CAP_SYS_MODULE` in the initial user namespace, which the low-privileged attacker cannot obtain via user namespaces \u2014 so an administrator\u0027s `rmmod vpa_pmu` (routine after a perf measurement session) is the required second-party action.\nS:U - The freed `struct pmu` and module text belong to the same kernel that the attacker\u0027s process already runs under, so impact stays within one security authority. Although `vpa_pmu` relates to KVM-on-PowerVM, the driver only runs on the L1 LPAR and the corruption never crosses the guest/host boundary.\nC:H - This is a use-after-free of a `struct pmu` living in vfree\u0027d module memory, including a stale `pmu-\u003epmu_disable_count` percpu pointer that is read on every event schedule; reclaiming that memory (e.g. by loading another module) turns the dangling reads into a kernel memory disclosure primitive.\nI:H - The dangling `event-\u003epmu` still carries `-\u003eadd`, `-\u003edel` and `-\u003eread` function pointers into freed module text, so the perf core makes indirect calls through attacker-influenceable reclaimed memory \u2014 a control-flow hijack primitive, not merely stale data.\nA:H - The commit documents the concrete outcome: a NULL pointer dereference in `event_sched_out()` reached from `__perf_remove_from_context()`, escalating to `Kernel panic - not syncing: Aiee, killing interrupt handler!` \u2014 a full system crash."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:56:45.289Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/70ea7c5189197c6f5acdcfd8a2651be2c41e2faa"
        },
        {
          "url": "https://git.kernel.org/stable/c/6cf045b51e2c5721db7e55305f09ee32741e00f9"
        },
        {
          "url": "https://git.kernel.org/stable/c/ff99d5b6a246715f2257123cdf6c4a29cb33aa78"
        }
      ],
      "title": "powerpc/perf: Fix ref-counting on the PMU \u0027vpa_pmu\u0027",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-22094",
    "datePublished": "2025-04-16T14:12:45.512Z",
    "dateReserved": "2024-12-29T08:45:45.818Z",
    "dateUpdated": "2026-08-05T11:56:45.289Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-22094",
      "date": "2026-09-15",
      "epss": "0.00207",
      "percentile": "0.11001"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-22094\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-04-16T15:16:03.593\",\"lastModified\":\"2026-07-30T06:22:12.737\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\npowerpc/perf: Fix ref-counting on the PMU \u0027vpa_pmu\u0027\\n\\nCommit 176cda0619b6 (\\\"powerpc/perf: Add perf interface to expose vpa\\ncounters\\\") introduced \u0027vpa_pmu\u0027 to expose Book3s-HV nested APIv2 provided\\nL1\u003c-\u003eL2 context switch latency counters to L1 user-space via\\nperf-events. However the newly introduced PMU named \u0027vpa_pmu\u0027 doesn\u0027t\\nassign ownership of the PMU to the module \u0027vpa_pmu\u0027. Consequently the\\nmodule \u0027vpa_pmu\u0027 can be unloaded while one of the perf-events are still\\nactive, which can lead to kernel oops and panic of the form below on a\\nPseries-LPAR:\\n\\nBUG: Kernel NULL pointer dereference on read at 0x00000058\\n\u003csnip\u003e\\n NIP [c000000000506cb8] event_sched_out+0x40/0x258\\n LR [c00000000050e8a4] __perf_remove_from_context+0x7c/0x2b0\\n Call Trace:\\n [c00000025fc3fc30] [c00000025f8457a8] 0xc00000025f8457a8 (unreliable)\\n [c00000025fc3fc80] [fffffffffffffee0] 0xfffffffffffffee0\\n [c00000025fc3fcd0] [c000000000501e70] event_function+0xa8/0x120\\n\u003csnip\u003e\\n Kernel panic - not syncing: Aiee, killing interrupt handler!\\n\\nFix this by adding the module ownership to \u0027vpa_pmu\u0027 so that the module\\n\u0027vpa_pmu\u0027 is ref-counted and prevented from being unloaded when perf-events\\nare initialized.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: powerpc/perf: Se corrige el conteo de referencias en la PMU \u0027vpa_pmu\u0027. El commit 176cda0619b6 (\\\"powerpc/perf: A\u00f1adir interfaz perf para exponer contadores vpa\\\") introdujo \u0027vpa_pmu\u0027 para exponer los contadores de latencia de cambio de contexto L1\u0026lt;-\u0026gt;L2 proporcionados por la APIv2 anidada de Book3s-HV al espacio de usuario L1 mediante eventos perf. Sin embargo, la nueva PMU, denominada \u0027vpa_pmu\u0027, no asigna la propiedad de la PMU al m\u00f3dulo \u0027vpa_pmu\u0027. En consecuencia, el m\u00f3dulo \u0027vpa_pmu\u0027 se puede descargar mientras uno de los eventos de rendimiento a\u00fan est\u00e1 activo, lo que puede provocar errores y p\u00e1nico en el kernel del formato siguiente en un Pseries-LPAR: ERROR: Desreferencia de puntero NULL del kernel en lectura en 0x00000058  NIP [c000000000506cb8] event_sched_out+0x40/0x258 LR [c00000000050e8a4] __perf_remove_from_context+0x7c/0x2b0 Rastreo de llamadas: [c00000025fc3fc30] [c00000025f8457a8] 0xc00000025f8457a8 (no confiable) [c00000025fc3fc80] [ffffffffffffffee0] 0xffffffffffffffee0 [c00000025fc3fcd0] [c000000000501e70] event_function+0xa8/0x120  P\u00e1nico del kernel: no se sincroniza: \u00a1Ay, se est\u00e1 eliminando el controlador de interrupciones! Para solucionarlo, agregue la propiedad del m\u00f3dulo a \u0027vpa_pmu\u0027 para que se contabilice y se evite su descarga al inicializar eventos de rendimiento.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"arch/powerpc/perf/vpa-pmu.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"176cda0619b6c17a553625f6e2fcbc3981ad667d\",\"lessThan\":\"70ea7c5189197c6f5acdcfd8a2651be2c41e2faa\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"176cda0619b6c17a553625f6e2fcbc3981ad667d\",\"lessThan\":\"6cf045b51e2c5721db7e55305f09ee32741e00f9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"176cda0619b6c17a553625f6e2fcbc3981ad667d\",\"lessThan\":\"ff99d5b6a246715f2257123cdf6c4a29cb33aa78\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"arch/powerpc/perf/vpa-pmu.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.13\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.13\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13.11\",\"lessThanOrEqual\":\"6.13.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.14.2\",\"lessThanOrEqual\":\"6.14.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":7.3,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.3,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.13.11\",\"matchCriteriaId\":\"E7E864B0-8C00-4679-BA55-659B4C9C3AD3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.14\",\"versionEndExcluding\":\"6.14.2\",\"matchCriteriaId\":\"FADAE5D8-4808-442C-B218-77B2CE8780A0\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/6cf045b51e2c5721db7e55305f09ee32741e00f9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/70ea7c5189197c6f5acdcfd8a2651be2c41e2faa\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ff99d5b6a246715f2257123cdf6c4a29cb33aa78\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:21:17+00:00",
      "cve": "CVE-2025-22094",
      "id": "CVE-2025-22094",
      "initial_release_date": "2025-04-16T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: powerpc/perf: Fix ref-counting on the PMU \u0027vpa_pmu\u0027",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-22094.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-29T01:24:57Z",
      "cve": "CVE-2025-22094",
      "id": "CVE-2025-22094",
      "initial_release_date": "2025-04-23T02:38:49Z",
      "product_status:known_not_affected": "467",
      "product_status:recommended": "175",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-22094",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-22094.json",
      "version": "19"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.