{"id":"CVE-2025-38424","revision":"f470781f56644fd48ba646c76b1a7ec4","records":[{"revision":"f470781f56644fd48ba646c76b1a7ec4","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-38424","aliases":[],"title":"perf: Fix sample vs do_exit()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nperf: Fix sample vs do_exit()\n\nBaisheng Gao reported an ARM64 crash, which Mark decoded as being a\nsynchronous external abort -- most likely due to trying to access\nMMIO in bad ways.\n\nThe crash further shows perf trying to do a user stack sample while in\nexit_mmap()'s tlb_finish_mmu() -- i.e. while tearing down the address\nspace it is trying to access.\n\nIt turns out that we stop perf after we tear down the userspace mm; a\nreceipie for disaster, since perf likes to access userspace for\nvarious reasons.\n\nFlip this order by moving up where we stop perf in do_exit().\n\nAdditionally, harden PERF_SAMPLE_CALLCHAIN and PERF_SAMPLE_STACK_USER\nto abort when the current task does not have an mm (exit_mm() makes\nsure to set current->mm = NULL; before commencing with the actual\nteardown). Such that CPU wide events don't trip on this same problem.","state":0,"publishedAt":"2025-07-25T14:16:44.846+00:00","modifiedAt":"2026-10-15T21:52:15.805+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"kernel/events/core.c\",\n                        \"kernel/exit.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"c5ebcedb566ef17bda7b02686e0d658a7bb42ee7\",\n                            \"lessThan\": \"7b8f3c72175c6a63a95cf2e219f8b78e2baad34e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"c5ebcedb566ef17bda7b02686e0d658a7bb42ee7\",\n                            \"lessThan\": \"507c9a595bad3abd107c6a8857d7fd125d89f386\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"c5ebcedb566ef17bda7b02686e0d658a7bb42ee7\",\n                            \"lessThan\": \"a9f6aab7910a0ef2895797f15c947f6d1053160f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"c5ebcedb566ef17bda7b02686e0d658a7bb42ee7\",\n                            \"lessThan\": \"975ffddfa2e19823c719459d2364fcaa17673964\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"c5ebcedb566ef17bda7b02686e0d658a7bb42ee7\",\n                            \"lessThan\": \"2ee6044a693735396bb47eeaba1ac3ae26c1c99b\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"c5ebcedb566ef17bda7b02686e0d658a7bb42ee7\",\n                            \"lessThan\": \"456019adaa2f5366b89c868dea9b483179bece54\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"c5ebcedb566ef17bda7b02686e0d658a7bb42ee7\",\n                            \"lessThan\": \"7311970d07c4606362081250da95f2c7901fc0db\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"c5ebcedb566ef17bda7b02686e0d658a7bb42ee7\",\n                            \"lessThan\": \"4f6fc782128355931527cefe3eb45338abd8ab39\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"kernel/events/core.c\",\n                        \"kernel/exit.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"3.7\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"3.7\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.4.295\",\n                            \"lessThanOrEqual\": \"5.4.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.239\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.186\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.142\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.95\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.35\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.15.4\",\n                            \"lessThanOrEqual\": \"6.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.16\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/7b8f3c72175c6a63a95cf2e219f8b78e2baad34e","https://git.kernel.org/stable/c/507c9a595bad3abd107c6a8857d7fd125d89f386","https://git.kernel.org/stable/c/a9f6aab7910a0ef2895797f15c947f6d1053160f","https://git.kernel.org/stable/c/975ffddfa2e19823c719459d2364fcaa17673964","https://git.kernel.org/stable/c/2ee6044a693735396bb47eeaba1ac3ae26c1c99b","https://git.kernel.org/stable/c/456019adaa2f5366b89c868dea9b483179bece54","https://git.kernel.org/stable/c/7311970d07c4606362081250da95f2c7901fc0db","https://git.kernel.org/stable/c/4f6fc782128355931527cefe3eb45338abd8ab39"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-38424","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-38424","identifiers":["CVE-2025-38424"]},"retained":false,"historicalAffected":[]}],"coverage":[]}