CVE-2025-39821 (GCVE-0-2025-39821)

Vulnerability from cvelistv5 – Published: 2025-09-16 13:00 – Updated: 2025-09-29 06:00
VLAI?
Summary
In the Linux kernel, the following vulnerability has been resolved: perf: Avoid undefined behavior from stopping/starting inactive events Calling pmu->start()/stop() on perf events in PERF_EVENT_STATE_OFF can leave event->hw.idx at -1. When PMU drivers later attempt to use this negative index as a shift exponent in bitwise operations, it leads to UBSAN shift-out-of-bounds reports. The issue is a logical flaw in how event groups handle throttling when some members are intentionally disabled. Based on the analysis and the reproducer provided by Mark Rutland (this issue on both arm64 and x86-64). The scenario unfolds as follows: 1. A group leader event is configured with a very aggressive sampling period (e.g., sample_period = 1). This causes frequent interrupts and triggers the throttling mechanism. 2. A child event in the same group is created in a disabled state (.disabled = 1). This event remains in PERF_EVENT_STATE_OFF. Since it hasn't been scheduled onto the PMU, its event->hw.idx remains initialized at -1. 3. When throttling occurs, perf_event_throttle_group() and later perf_event_unthrottle_group() iterate through all siblings, including the disabled child event. 4. perf_event_throttle()/unthrottle() are called on this inactive child event, which then call event->pmu->start()/stop(). 5. The PMU driver receives the event with hw.idx == -1 and attempts to use it as a shift exponent. e.g., in macros like PMCNTENSET(idx), leading to the UBSAN report. The throttling mechanism attempts to start/stop events that are not actively scheduled on the hardware. Move the state check into perf_event_throttle()/perf_event_unthrottle() so that inactive events are skipped entirely. This ensures only active events with a valid hw.idx are processed, preventing undefined behavior and silencing UBSAN warnings. The corrected check ensures true before proceeding with PMU operations. The problem can be reproduced with the syzkaller reproducer:
Severity ?
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 9734e25fbf5ae68eb04234b2cd14a4b36ab89141 , < d689135aa9c5e4e0eab5a92bbe35dab0c8d6677f (git)
Affected: 9734e25fbf5ae68eb04234b2cd14a4b36ab89141 , < b64fdd422a85025b5e91ead794db9d3ef970e369 (git)
Create a notification for this product.
    Linux Linux Affected: 6.16
Unaffected: 0 , < 6.16 (semver)
Unaffected: 6.16.5 , ≤ 6.16.* (semver)
Unaffected: 6.17 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/events/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d689135aa9c5e4e0eab5a92bbe35dab0c8d6677f",
              "status": "affected",
              "version": "9734e25fbf5ae68eb04234b2cd14a4b36ab89141",
              "versionType": "git"
            },
            {
              "lessThan": "b64fdd422a85025b5e91ead794db9d3ef970e369",
              "status": "affected",
              "version": "9734e25fbf5ae68eb04234b2cd14a4b36ab89141",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/events/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "lessThan": "6.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.5",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf: Avoid undefined behavior from stopping/starting inactive events\n\nCalling pmu-\u003estart()/stop() on perf events in PERF_EVENT_STATE_OFF can\nleave event-\u003ehw.idx at -1. When PMU drivers later attempt to use this\nnegative index as a shift exponent in bitwise operations, it leads to UBSAN\nshift-out-of-bounds reports.\n\nThe issue is a logical flaw in how event groups handle throttling when some\nmembers are intentionally disabled. Based on the analysis and the\nreproducer provided by Mark Rutland (this issue on both arm64 and x86-64).\n\nThe scenario unfolds as follows:\n\n 1. A group leader event is configured with a very aggressive sampling\n    period (e.g., sample_period = 1). This causes frequent interrupts and\n    triggers the throttling mechanism.\n 2. A child event in the same group is created in a disabled state\n    (.disabled = 1). This event remains in PERF_EVENT_STATE_OFF.\n    Since it hasn\u0027t been scheduled onto the PMU, its event-\u003ehw.idx remains\n    initialized at -1.\n 3. When throttling occurs, perf_event_throttle_group() and later\n    perf_event_unthrottle_group() iterate through all siblings, including\n    the disabled child event.\n 4. perf_event_throttle()/unthrottle() are called on this inactive child\n    event, which then call event-\u003epmu-\u003estart()/stop().\n 5. The PMU driver receives the event with hw.idx == -1 and attempts to\n    use it as a shift exponent. e.g., in macros like PMCNTENSET(idx),\n    leading to the UBSAN report.\n\nThe throttling mechanism attempts to start/stop events that are not\nactively scheduled on the hardware.\n\nMove the state check into perf_event_throttle()/perf_event_unthrottle() so\nthat inactive events are skipped entirely. This ensures only active events\nwith a valid hw.idx are processed, preventing undefined behavior and\nsilencing UBSAN warnings. The corrected check ensures true before\nproceeding with PMU operations.\n\nThe problem can be reproduced with the syzkaller reproducer:"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-29T06:00:21.008Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d689135aa9c5e4e0eab5a92bbe35dab0c8d6677f"
        },
        {
          "url": "https://git.kernel.org/stable/c/b64fdd422a85025b5e91ead794db9d3ef970e369"
        }
      ],
      "title": "perf: Avoid undefined behavior from stopping/starting inactive events",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39821",
    "datePublished": "2025-09-16T13:00:20.805Z",
    "dateReserved": "2025-04-16T07:20:57.139Z",
    "dateUpdated": "2025-09-29T06:00:21.008Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-39821\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-09-16T13:15:59.300\",\"lastModified\":\"2025-12-02T18:35:40.680\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nperf: Avoid undefined behavior from stopping/starting inactive events\\n\\nCalling pmu-\u003estart()/stop() on perf events in PERF_EVENT_STATE_OFF can\\nleave event-\u003ehw.idx at -1. When PMU drivers later attempt to use this\\nnegative index as a shift exponent in bitwise operations, it leads to UBSAN\\nshift-out-of-bounds reports.\\n\\nThe issue is a logical flaw in how event groups handle throttling when some\\nmembers are intentionally disabled. Based on the analysis and the\\nreproducer provided by Mark Rutland (this issue on both arm64 and x86-64).\\n\\nThe scenario unfolds as follows:\\n\\n 1. A group leader event is configured with a very aggressive sampling\\n    period (e.g., sample_period = 1). This causes frequent interrupts and\\n    triggers the throttling mechanism.\\n 2. A child event in the same group is created in a disabled state\\n    (.disabled = 1). This event remains in PERF_EVENT_STATE_OFF.\\n    Since it hasn\u0027t been scheduled onto the PMU, its event-\u003ehw.idx remains\\n    initialized at -1.\\n 3. When throttling occurs, perf_event_throttle_group() and later\\n    perf_event_unthrottle_group() iterate through all siblings, including\\n    the disabled child event.\\n 4. perf_event_throttle()/unthrottle() are called on this inactive child\\n    event, which then call event-\u003epmu-\u003estart()/stop().\\n 5. The PMU driver receives the event with hw.idx == -1 and attempts to\\n    use it as a shift exponent. e.g., in macros like PMCNTENSET(idx),\\n    leading to the UBSAN report.\\n\\nThe throttling mechanism attempts to start/stop events that are not\\nactively scheduled on the hardware.\\n\\nMove the state check into perf_event_throttle()/perf_event_unthrottle() so\\nthat inactive events are skipped entirely. This ensures only active events\\nwith a valid hw.idx are processed, preventing undefined behavior and\\nsilencing UBSAN warnings. The corrected check ensures true before\\nproceeding with PMU operations.\\n\\nThe problem can be reproduced with the syzkaller reproducer:\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.16\",\"versionEndExcluding\":\"6.16.5\",\"matchCriteriaId\":\"5EAC2366-3E84-4F52-AF72-DB8127DB7367\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"327D22EF-390B-454C-BD31-2ED23C998A1C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"C730CD9A-D969-4A8E-9522-162AAF7C0EE9\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/b64fdd422a85025b5e91ead794db9d3ef970e369\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d689135aa9c5e4e0eab5a92bbe35dab0c8d6677f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.