CVE-2025-21895

published 2025-04-01

CVE-2025-21895: In the Linux kernel, the following vulnerability has been resolved: perf/core: Order the PMU list to fix warning about unordered pmu_ctx_list Syskaller…

Priority P4 15 medium 4.7 CVSS 3.1

AV L AC H PR L UI N S U C N I N A H

In the Linux kernel, the following vulnerability has been resolved:

perf/core: Order the PMU list to fix warning about unordered pmu_ctx_list

Syskaller triggers a warning due to prev_epc->pmu != next_epc->pmu in
perf_event_swap_task_ctx_data(). vmcore shows that two lists have the same
perf_event_pmu_context, but not in the same order.

The problem is that the order of pmu_ctx_list for the parent is impacted by
the time when an event/PMU is added. While the order for a child is
impacted by the event order in the pinned_groups and flexible_groups. So
the order of pmu_ctx_list in the parent and child may be different.

To fix this problem, insert the perf_event_pmu_context to its proper place
after iteration of the pmu_ctx_list.

The follow testcase can trigger above warning:

# perf record -e cycles --call-graph lbr -- taskset -c 3 ./a.out &
# perf stat -e cpu-clock,cs -p xxx // xxx is the pid of a.out

test.c

void main() {
int count = 0;
pid_t pid;

printf("%d running\n", getpid());
sleep(30);
printf("running\n");

pid = fork();
if (pid == -1) {
printf("fork error\n");
return;
}
if (pid == 0) {
while (1) {
count++;
}
} else {
while (1) {
count++;
}
}
}

The testcase first opens an LBR event, so it will allocate task_ctx_data,
and then open tracepoint and software events, so the parent context will
have 3 different perf_event_pmu_contexts. On inheritance, child ctx will
insert the perf_event_pmu_context in another order and the warning will
trigger.

[ mingo: Tidied up the changelog. ]

Affected

13 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 6.12.19-1 (forky)	linux 6.12.19-1 (forky)
linux	linux	—	—
linux	linux	>= bd27568117664b8b3e259721393df420ed51f57b < f0c3971405cef6892844016aa710121a02da3a23	f0c3971405cef6892844016aa710121a02da3a23
linux	linux	>= bd27568117664b8b3e259721393df420ed51f57b < 7d582eb6e4e100959ba07083d7563453c8c2a343	7d582eb6e4e100959ba07083d7563453c8c2a343
linux	linux	>= bd27568117664b8b3e259721393df420ed51f57b < 3e812a70732d84b7873cea61a7f6349b9a9dcbf5	3e812a70732d84b7873cea61a7f6349b9a9dcbf5
linux	linux	>= bd27568117664b8b3e259721393df420ed51f57b < 2016066c66192a99d9e0ebf433789c490a6785a2	2016066c66192a99d9e0ebf433789c490a6785a2
linux	linux_kernel	—	—
linux	linux_kernel	>= 0 < 6.12.19-1	6.12.19-1
linux	linux_kernel	>= 0 < 6.12.19-1	6.12.19-1
linux	linux_kernel	>= 0 < 6.8.0-84.84	6.8.0-84.84
linux	linux_kernel	>= 6.13 < 6.13.6	6.13.6
linux	linux_kernel	>= 6.2 < 6.6.81	6.6.81
linux	linux_kernel	>= 6.7 < 6.12.18	6.12.18

CVSS provenance

nvd v3.1 4.7 MEDIUM CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

osv 5.5 MEDIUM

vendor_ubuntu 5.5 MEDIUM

vendor_debian 4.7 LOW

vendor_redhat 4.7 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-362