In the Linux kernel, the following vulnerability has been resolved:
perf: Fix sample vs do_exit()
Baisheng Gao reported an ARM64 crash, which Mark decoded as being a synchronous external abort -- most likely due to trying to access MMIO in bad ways.
The crash further shows perf trying to do a user stack sample while in exitmmap()'s tlbfinish_mmu() -- i.e. while tearing down the address space it is trying to access.
It turns out that we stop perf after we tear down the userspace mm; a receipie for disaster, since perf likes to access userspace for various reasons.
Flip this order by moving up where we stop perf in do_exit().
Additionally, harden PERFSAMPLECALLCHAIN and PERFSAMPLESTACKUSER to abort when the current task does not have an mm (exitmm() makes sure to set current->mm = NULL; before commencing with the actual teardown). Such that CPU wide events don't trip on this same problem.
[
{
"id": "CVE-2025-38424-013ae22c",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "kernel/exit.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@975ffddfa2e19823c719459d2364fcaa17673964",
"signature_type": "Line",
"digest": {
"line_hashes": [
"285714079123593492509530916371439983434",
"113502440038515659335296696224845221353",
"124823267379127287307309410134189467923",
"154503393308000053779451440013939871731",
"133248442527605856966724243490397614792",
"297404225167689225189115850902130296534",
"88985859324003047847783009437454663488"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-38424-04d5822e",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "kernel/events/core.c",
"function": "perf_sample_ustack_size"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@975ffddfa2e19823c719459d2364fcaa17673964",
"signature_type": "Function",
"digest": {
"length": 405.0,
"function_hash": "288717927296554446605216933603355944871"
}
},
{
"id": "CVE-2025-38424-093df6af",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "kernel/events/core.c",
"function": "perf_sample_ustack_size"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b8f3c72175c6a63a95cf2e219f8b78e2baad34e",
"signature_type": "Function",
"digest": {
"length": 405.0,
"function_hash": "288717927296554446605216933603355944871"
}
},
{
"id": "CVE-2025-38424-1bda691e",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "kernel/exit.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@456019adaa2f5366b89c868dea9b483179bece54",
"signature_type": "Line",
"digest": {
"line_hashes": [
"285714079123593492509530916371439983434",
"113502440038515659335296696224845221353",
"124823267379127287307309410134189467923",
"154503393308000053779451440013939871731",
"133248442527605856966724243490397614792",
"297404225167689225189115850902130296534",
"88985859324003047847783009437454663488"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-38424-2cadba39",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "kernel/exit.c",
"function": "do_exit"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@975ffddfa2e19823c719459d2364fcaa17673964",
"signature_type": "Function",
"digest": {
"length": 1759.0,
"function_hash": "203400401160491846493949578486526611810"
}
},
{
"id": "CVE-2025-38424-30a39fab",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "kernel/events/core.c",
"function": "perf_callchain"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@507c9a595bad3abd107c6a8857d7fd125d89f386",
"signature_type": "Function",
"digest": {
"length": 453.0,
"function_hash": "324792508994022473578805582368313480221"
}
},
{
"id": "CVE-2025-38424-3b529c97",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "kernel/events/core.c",
"function": "perf_sample_ustack_size"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2ee6044a693735396bb47eeaba1ac3ae26c1c99b",
"signature_type": "Function",
"digest": {
"length": 405.0,
"function_hash": "288717927296554446605216933603355944871"
}
},
{
"id": "CVE-2025-38424-3b70c955",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "kernel/exit.c",
"function": "do_exit"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@507c9a595bad3abd107c6a8857d7fd125d89f386",
"signature_type": "Function",
"digest": {
"length": 2224.0,
"function_hash": "271561395722242866925127279594966359959"
}
},
{
"id": "CVE-2025-38424-487417ce",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "kernel/events/core.c",
"function": "perf_callchain"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@456019adaa2f5366b89c868dea9b483179bece54",
"signature_type": "Function",
"digest": {
"length": 453.0,
"function_hash": "324792508994022473578805582368313480221"
}
},
{
"id": "CVE-2025-38424-4ce83f1e",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "kernel/exit.c",
"function": "do_exit"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2ee6044a693735396bb47eeaba1ac3ae26c1c99b",
"signature_type": "Function",
"digest": {
"length": 1740.0,
"function_hash": "308784937763794500314508506497545977093"
}
},
{
"id": "CVE-2025-38424-51e78cde",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "kernel/events/core.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b8f3c72175c6a63a95cf2e219f8b78e2baad34e",
"signature_type": "Line",
"digest": {
"line_hashes": [
"309764108017450696891302544512752663494",
"255962189404313696804278869151878725288",
"29622739599068677847692095215175595519",
"135868285825759498635893649828812511655",
"96243746542728600356835471852419015206",
"164828775616245365977552653571499302702"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-38424-5c3841b7",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "kernel/exit.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2ee6044a693735396bb47eeaba1ac3ae26c1c99b",
"signature_type": "Line",
"digest": {
"line_hashes": [
"285714079123593492509530916371439983434",
"113502440038515659335296696224845221353",
"124823267379127287307309410134189467923",
"154503393308000053779451440013939871731",
"133248442527605856966724243490397614792",
"297404225167689225189115850902130296534",
"88985859324003047847783009437454663488"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-38424-6ec36073",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "kernel/exit.c",
"function": "do_exit"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b8f3c72175c6a63a95cf2e219f8b78e2baad34e",
"signature_type": "Function",
"digest": {
"length": 2246.0,
"function_hash": "246802154440372458289281181158874643870"
}
},
{
"id": "CVE-2025-38424-73ca73b6",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "kernel/events/core.c",
"function": "perf_sample_ustack_size"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@507c9a595bad3abd107c6a8857d7fd125d89f386",
"signature_type": "Function",
"digest": {
"length": 405.0,
"function_hash": "288717927296554446605216933603355944871"
}
},
{
"id": "CVE-2025-38424-7e08e441",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "kernel/events/core.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2ee6044a693735396bb47eeaba1ac3ae26c1c99b",
"signature_type": "Line",
"digest": {
"line_hashes": [
"309764108017450696891302544512752663494",
"255962189404313696804278869151878725288",
"29622739599068677847692095215175595519",
"135868285825759498635893649828812511655",
"96243746542728600356835471852419015206",
"164828775616245365977552653571499302702"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-38424-8171387a",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "kernel/events/core.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@507c9a595bad3abd107c6a8857d7fd125d89f386",
"signature_type": "Line",
"digest": {
"line_hashes": [
"309764108017450696891302544512752663494",
"255962189404313696804278869151878725288",
"29622739599068677847692095215175595519",
"135868285825759498635893649828812511655",
"96243746542728600356835471852419015206",
"164828775616245365977552653571499302702"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-38424-83eb9d94",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "kernel/exit.c",
"function": "do_exit"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@456019adaa2f5366b89c868dea9b483179bece54",
"signature_type": "Function",
"digest": {
"length": 1717.0,
"function_hash": "163703085004349916318604158346420907998"
}
},
{
"id": "CVE-2025-38424-a32ad99b",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "kernel/events/core.c",
"function": "perf_callchain"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@975ffddfa2e19823c719459d2364fcaa17673964",
"signature_type": "Function",
"digest": {
"length": 453.0,
"function_hash": "324792508994022473578805582368313480221"
}
},
{
"id": "CVE-2025-38424-c3fc8820",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "kernel/exit.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@507c9a595bad3abd107c6a8857d7fd125d89f386",
"signature_type": "Line",
"digest": {
"line_hashes": [
"285714079123593492509530916371439983434",
"113502440038515659335296696224845221353",
"124823267379127287307309410134189467923",
"154503393308000053779451440013939871731",
"133248442527605856966724243490397614792",
"297404225167689225189115850902130296534",
"88985859324003047847783009437454663488"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-38424-c4c5879e",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "kernel/events/core.c",
"function": "perf_callchain"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2ee6044a693735396bb47eeaba1ac3ae26c1c99b",
"signature_type": "Function",
"digest": {
"length": 453.0,
"function_hash": "324792508994022473578805582368313480221"
}
},
{
"id": "CVE-2025-38424-d703d613",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "kernel/events/core.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@456019adaa2f5366b89c868dea9b483179bece54",
"signature_type": "Line",
"digest": {
"line_hashes": [
"309764108017450696891302544512752663494",
"255962189404313696804278869151878725288",
"29622739599068677847692095215175595519",
"135868285825759498635893649828812511655",
"96243746542728600356835471852419015206",
"164828775616245365977552653571499302702"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-38424-db0b6686",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "kernel/events/core.c",
"function": "perf_sample_ustack_size"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@456019adaa2f5366b89c868dea9b483179bece54",
"signature_type": "Function",
"digest": {
"length": 405.0,
"function_hash": "288717927296554446605216933603355944871"
}
},
{
"id": "CVE-2025-38424-df32d2c4",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "kernel/exit.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b8f3c72175c6a63a95cf2e219f8b78e2baad34e",
"signature_type": "Line",
"digest": {
"line_hashes": [
"285714079123593492509530916371439983434",
"113502440038515659335296696224845221353",
"124823267379127287307309410134189467923",
"155399567571756463576005579559597698341",
"103286570425511861131083945323954749264",
"205463133757609522877635128239336349720",
"88985859324003047847783009437454663488"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-38424-e9887cda",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "kernel/events/core.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@975ffddfa2e19823c719459d2364fcaa17673964",
"signature_type": "Line",
"digest": {
"line_hashes": [
"309764108017450696891302544512752663494",
"255962189404313696804278869151878725288",
"29622739599068677847692095215175595519",
"135868285825759498635893649828812511655",
"96243746542728600356835471852419015206",
"164828775616245365977552653571499302702"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-38424-f4b2b162",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "kernel/events/core.c",
"function": "perf_callchain"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b8f3c72175c6a63a95cf2e219f8b78e2baad34e",
"signature_type": "Function",
"digest": {
"length": 453.0,
"function_hash": "324792508994022473578805582368313480221"
}
}
]