CVE-2025-39821

Full vulnerability record from the local CVENow database.

Description

In the Linux kernel, the following vulnerability has been resolved: perf: Avoid undefined behavior from stopping/starting inactive events Calling pmu->start()/stop() on perf events in PERF_EVENT_STATE_OFF can leave event->hw.idx at -1. When PMU drivers later attempt to use this negative index as a shift exponent in bitwise operations, it leads to UBSAN shift-out-of-bounds reports. The issue is a logical flaw in how event groups handle throttling when some members are intentionally disabled. Based on the analysis and the reproducer provided by Mark Rutland (this issue on both arm64 and x86-64). The scenario unfolds as follows: 1. A group leader event is configured with a very aggressive sampling period (e.g., sample_period = 1). This causes frequent interrupts and triggers the throttling mechanism. 2. A child event in the same group is created in a disabled state (.disabled = 1). This event remains in PERF_EVENT_STATE_OFF. Since it hasn't been scheduled onto the PMU, its event->hw.idx remains initialized at -1. 3. When throttling occurs, perf_event_throttle_group() and later perf_event_unthrottle_group() iterate through all siblings, including the disabled child event. 4. perf_event_throttle()/unthrottle() are called on this inactive child event, which then call event->pmu->start()/stop(). 5. The PMU driver receives the event with hw.idx == -1 and attempts to use it as a shift exponent. e.g., in macros like PMCNTENSET(idx), leading to the UBSAN report. The throttling mechanism attempts to start/stop events that are not actively scheduled on the hardware. Move the state check into perf_event_throttle()/perf_event_unthrottle() so that inactive events are skipped entirely. This ensures only active events with a valid hw.idx are processed, preventing undefined behavior and silencing UBSAN warnings. The corrected check ensures true before proceeding with PMU operations. The problem can be reproduced with the syzkaller reproducer:

Severity

HIGH

CVSS score

7.8 (v3.1)

Vulnerability status

Modified

Source identifier

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Published

2025-09-16 13:15:59.300000

Last modified

2026-10-19 21:10:00.160000

View original CVE JSON

{
  "id": "CVE-2025-39821",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2025-09-16T13:15:59.300",
  "lastModified": "2026-10-19T21:10:00.160",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf: Avoid undefined behavior from stopping/starting inactive events\n\nCalling pmu->start()/stop() on perf events in PERF_EVENT_STATE_OFF can\nleave event->hw.idx at -1. When PMU drivers later attempt to use this\nnegative index as a shift exponent in bitwise operations, it leads to UBSAN\nshift-out-of-bounds reports.\n\nThe issue is a logical flaw in how event groups handle throttling when some\nmembers are intentionally disabled. Based on the analysis and the\nreproducer provided by Mark Rutland (this issue on both arm64 and x86-64).\n\nThe scenario unfolds as follows:\n\n 1. A group leader event is configured with a very aggressive sampling\n    period (e.g., sample_period = 1). This causes frequent interrupts and\n    triggers the throttling mechanism.\n 2. A child event in the same group is created in a disabled state\n    (.disabled = 1). This event remains in PERF_EVENT_STATE_OFF.\n    Since it hasn't been scheduled onto the PMU, its event->hw.idx remains\n    initialized at -1.\n 3. When throttling occurs, perf_event_throttle_group() and later\n    perf_event_unthrottle_group() iterate through all siblings, including\n    the disabled child event.\n 4. perf_event_throttle()/unthrottle() are called on this inactive child\n    event, which then call event->pmu->start()/stop().\n 5. The PMU driver receives the event with hw.idx == -1 and attempts to\n    use it as a shift exponent. e.g., in macros like PMCNTENSET(idx),\n    leading to the UBSAN report.\n\nThe throttling mechanism attempts to start/stop events that are not\nactively scheduled on the hardware.\n\nMove the state check into perf_event_throttle()/perf_event_unthrottle() so\nthat inactive events are skipped entirely. This ensures only active events\nwith a valid hw.idx are processed, preventing undefined behavior and\nsilencing UBSAN warnings. The corrected check ensures true before\nproceeding with PMU operations.\n\nThe problem can be reproduced with the syzkaller reproducer:"
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nperf: Evitar comportamiento indefinido al detener/iniciar eventos inactivos\n\nLlamar a pmu->start()/stop() en eventos perf en PERF_EVENT_STATE_OFF puede dejar event->hw.idx en -1. Cuando los controladores de PMU intentan más tarde usar este índice negativo como un exponente de desplazamiento en operaciones bit a bit, esto lleva a informes de UBSAN de desplazamiento fuera de límites.\n\nEl problema es un fallo lógico en cómo los grupos de eventos manejan la limitación cuando algunos miembros están deshabilitados intencionalmente. Basado en el análisis y el reproductor proporcionado por Mark Rutland (este problema tanto en arm64 como en x86-64).\n\nEl escenario se desarrolla de la siguiente manera:\n\n1. Un evento líder de grupo se configura con un período de muestreo muy agresivo (por ejemplo, sample_period = 1). Esto causa interrupciones frecuentes y activa el mecanismo de limitación.\n2. Se crea un evento hijo en el mismo grupo en un estado deshabilitado (.disabled = 1). Este evento permanece en PERF_EVENT_STATE_OFF. Dado que no ha sido programado en la PMU, su event->hw.idx permanece inicializado en -1.\n3. Cuando ocurre la limitación, perf_event_throttle_group() y más tarde perf_event_unthrottle_group() iteran a través de todos los hermanos, incluyendo el evento hijo deshabilitado.\n4. Se llama a perf_event_throttle()/unthrottle() en este evento hijo inactivo, que luego llaman a event->pmu->start()/stop().\n5. El controlador de PMU recibe el evento con hw.idx == -1 e intenta usarlo como un exponente de desplazamiento. Por ejemplo, en macros como PMCNTENSET(idx), lo que lleva al informe de UBSAN.\n\nEl mecanismo de limitación intenta iniciar/detener eventos que no están programados activamente en el hardware.\n\nMover la verificación de estado a perf_event_throttle()/perf_event_unthrottle() para que los eventos inactivos se omitan por completo. Esto asegura que solo los eventos activos con un hw.idx válido sean procesados, previniendo comportamiento indefinido y silenciando las advertencias de UBSAN. La verificación corregida asegura verdadero antes de proceder con las operaciones de PMU.\n\nEl problema puede ser reproducido con el reproductor de syzkaller:"
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "kernel/events/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "9734e25fbf5ae68eb04234b2cd14a4b36ab89141",
              "lessThan": "d689135aa9c5e4e0eab5a92bbe35dab0c8d6677f",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "9734e25fbf5ae68eb04234b2cd14a4b36ab89141",
              "lessThan": "b64fdd422a85025b5e91ead794db9d3ef970e369",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "kernel/events/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "6.16",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "6.16",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.16.5",
              "lessThanOrEqual": "6.16.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.17",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9
      },
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-01-14T18:16:47.835074Z",
          "id": "CVE-2025-39821",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.16",
              "versionEndExcluding": "6.16.5",
              "matchCriteriaId": "5EAC2366-3E84-4F52-AF72-DB8127DB7367"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "327D22EF-390B-454C-BD31-2ED23C998A1C"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "C730CD9A-D969-4A8E-9522-162AAF7C0EE9"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/b64fdd422a85025b5e91ead794db9d3ef970e369",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/d689135aa9c5e4e0eab5a92bbe35dab0c8d6677f",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    }
  ]
}