GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-37878 (GCVE-0-2025-37878)

Vulnerability from cvelistv5 – Published: 2025-05-09 06:45 – Updated: 2026-05-23 15:58
VLAI
Title
perf/core: Fix WARN_ON(!ctx) in __free_event() for partial init
Summary
In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix WARN_ON(!ctx) in __free_event() for partial init Move the get_ctx(child_ctx) call and the child_event->ctx assignment to occur immediately after the child event is allocated. Ensure that child_event->ctx is non-NULL before any subsequent error path within inherit_event calls free_event(), satisfying the assumptions of the cleanup code. Details: There's no clear Fixes tag, because this bug is a side-effect of multiple interacting commits over time (up to 15 years old), not a single regression. The code initially incremented refcount then assigned context immediately after the child_event was created. Later, an early validity check for child_event was added before the refcount/assignment. Even later, a WARN_ON_ONCE() cleanup check was added, assuming event->ctx is valid if the pmu_ctx is valid. The problem is that the WARN_ON_ONCE() could trigger after the initial check passed but before child_event->ctx was assigned, violating its precondition. The solution is to assign child_event->ctx right after its initial validation. This ensures the context exists for any subsequent checks or cleanup routines, resolving the WARN_ON_ONCE(). To resolve it, defer the refcount update and child_event->ctx assignment directly after child_event->pmu_ctx is set but before checking if the parent event is orphaned. The cleanup routine depends on event->pmu_ctx being non-NULL before it verifies event->ctx is non-NULL. This also maintains the author's original intent of passing in child_ctx to find_get_pmu_context before its refcount/assignment. [ mingo: Expanded the changelog from another email by Gabriel Shahrouzi. ]
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 7ef5aa081f989ecfecc1df02068a80aebbd3ec31 , < 90dc6c1e3b200812da8d0aa030e1b7fda8226d0e (git)
Affected: 1209b0b29fd472e7dbd2b06544b019dd9f9b7e51 , < cb56cd11feabf99e08bc18960700a53322ffcea7 (git)
Affected: c70ca298036c58a88686ff388d3d367e9d21acf0 , < 0ba3a4ab76fd3367b9cb680cad70182c896c795c (git)
Affected: 315a50c6b1c6ce191f19f3372935d8e2ed9b53a6 (git)
Affected: 6.13.12 , < 6.14 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.12.24 , < 6.12.26 (semver)
Affected: 6.14.3 , < 6.14.5 (semver)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/events/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "90dc6c1e3b200812da8d0aa030e1b7fda8226d0e",
              "status": "affected",
              "version": "7ef5aa081f989ecfecc1df02068a80aebbd3ec31",
              "versionType": "git"
            },
            {
              "lessThan": "cb56cd11feabf99e08bc18960700a53322ffcea7",
              "status": "affected",
              "version": "1209b0b29fd472e7dbd2b06544b019dd9f9b7e51",
              "versionType": "git"
            },
            {
              "lessThan": "0ba3a4ab76fd3367b9cb680cad70182c896c795c",
              "status": "affected",
              "version": "c70ca298036c58a88686ff388d3d367e9d21acf0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "315a50c6b1c6ce191f19f3372935d8e2ed9b53a6",
              "versionType": "git"
            },
            {
              "lessThan": "6.14",
              "status": "affected",
              "version": "6.13.12",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/events/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6.12.26",
              "status": "affected",
              "version": "6.12.24",
              "versionType": "semver"
            },
            {
              "lessThan": "6.14.5",
              "status": "affected",
              "version": "6.14.3",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.26",
                  "versionStartIncluding": "6.12.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.5",
                  "versionStartIncluding": "6.14.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.13.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf/core: Fix WARN_ON(!ctx) in __free_event() for partial init\n\nMove the get_ctx(child_ctx) call and the child_event-\u003ectx assignment to\noccur immediately after the child event is allocated. Ensure that\nchild_event-\u003ectx is non-NULL before any subsequent error path within\ninherit_event calls free_event(), satisfying the assumptions of the\ncleanup code.\n\nDetails:\n\nThere\u0027s no clear Fixes tag, because this bug is a side-effect of\nmultiple interacting commits over time (up to 15 years old), not\na single regression.\n\nThe code initially incremented refcount then assigned context\nimmediately after the child_event was created. Later, an early\nvalidity check for child_event was added before the\nrefcount/assignment. Even later, a WARN_ON_ONCE() cleanup check was\nadded, assuming event-\u003ectx is valid if the pmu_ctx is valid.\nThe problem is that the WARN_ON_ONCE() could trigger after the initial\ncheck passed but before child_event-\u003ectx was assigned, violating its\nprecondition. The solution is to assign child_event-\u003ectx right after\nits initial validation. This ensures the context exists for any\nsubsequent checks or cleanup routines, resolving the WARN_ON_ONCE().\n\nTo resolve it, defer the refcount update and child_event-\u003ectx assignment\ndirectly after child_event-\u003epmu_ctx is set but before checking if the\nparent event is orphaned. The cleanup routine depends on\nevent-\u003epmu_ctx being non-NULL before it verifies event-\u003ectx is\nnon-NULL. This also maintains the author\u0027s original intent of passing\nin child_ctx to find_get_pmu_context before its refcount/assignment.\n\n[ mingo: Expanded the changelog from another email by Gabriel Shahrouzi. ]"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T15:58:30.579Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/90dc6c1e3b200812da8d0aa030e1b7fda8226d0e"
        },
        {
          "url": "https://git.kernel.org/stable/c/cb56cd11feabf99e08bc18960700a53322ffcea7"
        },
        {
          "url": "https://git.kernel.org/stable/c/0ba3a4ab76fd3367b9cb680cad70182c896c795c"
        }
      ],
      "title": "perf/core: Fix WARN_ON(!ctx) in __free_event() for partial init",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-37878",
    "datePublished": "2025-05-09T06:45:42.459Z",
    "dateReserved": "2025-04-16T04:51:23.960Z",
    "dateUpdated": "2026-05-23T15:58:30.579Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-37878",
      "date": "2026-09-15",
      "epss": "0.00264",
      "percentile": "0.18412"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-13T01:50:54.000Z",
      "cve": "CVE-2025-37878",
      "id": "msrc_CVE-2025-37878",
      "initial_release_date": "2025-07-11T00:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "7",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "perf/core: Fix WARN_ON(!ctx) in __free_event() for partial init",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-37878.json",
      "version": "7"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-37878\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-05-09T07:16:09.020\",\"lastModified\":\"2026-06-17T09:15:37.220\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nperf/core: Fix WARN_ON(!ctx) in __free_event() for partial init\\n\\nMove the get_ctx(child_ctx) call and the child_event-\u003ectx assignment to\\noccur immediately after the child event is allocated. Ensure that\\nchild_event-\u003ectx is non-NULL before any subsequent error path within\\ninherit_event calls free_event(), satisfying the assumptions of the\\ncleanup code.\\n\\nDetails:\\n\\nThere\u0027s no clear Fixes tag, because this bug is a side-effect of\\nmultiple interacting commits over time (up to 15 years old), not\\na single regression.\\n\\nThe code initially incremented refcount then assigned context\\nimmediately after the child_event was created. Later, an early\\nvalidity check for child_event was added before the\\nrefcount/assignment. Even later, a WARN_ON_ONCE() cleanup check was\\nadded, assuming event-\u003ectx is valid if the pmu_ctx is valid.\\nThe problem is that the WARN_ON_ONCE() could trigger after the initial\\ncheck passed but before child_event-\u003ectx was assigned, violating its\\nprecondition. The solution is to assign child_event-\u003ectx right after\\nits initial validation. This ensures the context exists for any\\nsubsequent checks or cleanup routines, resolving the WARN_ON_ONCE().\\n\\nTo resolve it, defer the refcount update and child_event-\u003ectx assignment\\ndirectly after child_event-\u003epmu_ctx is set but before checking if the\\nparent event is orphaned. The cleanup routine depends on\\nevent-\u003epmu_ctx being non-NULL before it verifies event-\u003ectx is\\nnon-NULL. This also maintains the author\u0027s original intent of passing\\nin child_ctx to find_get_pmu_context before its refcount/assignment.\\n\\n[ mingo: Expanded the changelog from another email by Gabriel Shahrouzi. ]\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: perf/core: Arregla WARN_ON(!ctx) en __free_event() para init parcial Mueve la llamada get_ctx(child_ctx) y la asignaci\u00f3n child_event-\u0026gt;ctx para que ocurran inmediatamente despu\u00e9s de que se asigne el evento secundario. Aseg\u00farate de que child_event-\u0026gt;ctx no sea NULL antes de cualquier ruta de error posterior dentro de las llamadas heritage_event a free_event(), satisfaciendo las suposiciones del c\u00f3digo de limpieza. Detalles: No hay una etiqueta Fixes clara, porque este error es un efecto secundario de m\u00faltiples confirmaciones interactivas a lo largo del tiempo (hasta 15 a\u00f1os de antig\u00fcedad), no una sola regresi\u00f3n. El c\u00f3digo inicialmente increment\u00f3 refcount y luego asign\u00f3 contexto inmediatamente despu\u00e9s de que se creara child_event. M\u00e1s tarde, se agreg\u00f3 una comprobaci\u00f3n de validez temprana para child_event antes de refcount/assignment. Incluso m\u00e1s tarde, se agreg\u00f3 una comprobaci\u00f3n de limpieza WARN_ON_ONCE(), asumiendo que event-\u0026gt;ctx es v\u00e1lido si pmu_ctx es v\u00e1lido. El problema radica en que WARN_ON_ONCE() podr\u00eda activarse despu\u00e9s de que se supere la comprobaci\u00f3n inicial, pero antes de que se asignara child_event-\u0026gt;ctx, incumpliendo su precondici\u00f3n. La soluci\u00f3n es asignar child_event-\u0026gt;ctx justo despu\u00e9s de su validaci\u00f3n inicial. Esto garantiza la existencia del contexto para cualquier comprobaci\u00f3n o rutina de limpieza posterior, resolviendo WARN_ON_ONCE(). Para solucionarlo, posponga la actualizaci\u00f3n del recuento de referencias y la asignaci\u00f3n de child_event-\u0026gt;ctx justo despu\u00e9s de que se configure child_event-\u0026gt;pmu_ctx, pero antes de comprobar si el evento principal est\u00e1 hu\u00e9rfano. La rutina de limpieza depende de que event-\u0026gt;pmu_ctx no sea NULL antes de verificar que event-\u0026gt;ctx no sea NULL. Esto tambi\u00e9n mantiene la intenci\u00f3n original del autor de pasar child_ctx a find_get_pmu_context antes de su recuento de referencias/asignaci\u00f3n. [mingo: Registro de cambios ampliado de otro correo electr\u00f3nico de Gabriel Shahrouzi].\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"kernel/events/core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7ef5aa081f989ecfecc1df02068a80aebbd3ec31\",\"lessThan\":\"90dc6c1e3b200812da8d0aa030e1b7fda8226d0e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1209b0b29fd472e7dbd2b06544b019dd9f9b7e51\",\"lessThan\":\"cb56cd11feabf99e08bc18960700a53322ffcea7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c70ca298036c58a88686ff388d3d367e9d21acf0\",\"lessThan\":\"0ba3a4ab76fd3367b9cb680cad70182c896c795c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"315a50c6b1c6ce191f19f3372935d8e2ed9b53a6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6.13.12\",\"lessThan\":\"6.14\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"kernel/events/core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.12.24\",\"lessThan\":\"6.12.26\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.14.3\",\"lessThan\":\"6.14.5\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-617\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"6.6.89\",\"matchCriteriaId\":\"4D51CA5E-345A-4098-B85D-3F2BED7BF3A0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.26\",\"matchCriteriaId\":\"22F52099-F422-4D19-8283-45F9F9BF4392\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.14.5\",\"matchCriteriaId\":\"6B25CA7E-4CD0-46DB-B4EF-13A3516071FB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"8D465631-2980-487A-8E65-40AE2B9F8ED1\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0ba3a4ab76fd3367b9cb680cad70182c896c795c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/90dc6c1e3b200812da8d0aa030e1b7fda8226d0e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cb56cd11feabf99e08bc18960700a53322ffcea7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-30T00:08:59+00:00",
      "cve": "CVE-2025-37878",
      "id": "CVE-2025-37878",
      "initial_release_date": "2025-05-09T00:00:00+00:00",
      "product_status:known_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: perf/core: Fix WARN_ON(!ctx) in __free_event() for partial init",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-37878.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-28T17:04:04Z",
      "cve": "CVE-2025-37878",
      "id": "CVE-2025-37878",
      "initial_release_date": "2025-05-10T02:52:26Z",
      "product_status:known_not_affected": "549",
      "product_status:recommended": "78",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-37878",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-37878.json",
      "version": "39"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.