CVE-2025-40359
BaseFortify
Publication date: 2025-12-16
Last updated on: 2025-12-18
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a global out-of-bounds memory access in the Linux kernel's perf subsystem on x86 Intel platforms. Specifically, when running the "perf mem record" command on a non-hybrid platform like CWF, the kernel attempts to access a structure (x86_hybrid_pmu) that does not exist, causing a KASAN (Kernel Address Sanitizer) global-out-of-bounds warning. The issue arises because the code does not properly check if the platform is hybrid before accessing this structure. The fix involves adding a check (is_hybrid()) before accessing the structure to prevent the out-of-bounds access.
How can this vulnerability impact me? :
This vulnerability can cause the Linux kernel to perform an out-of-bounds memory read, which may lead to system instability, crashes, or unexpected behavior when using the perf tool on affected platforms. It could potentially be exploited to cause denial of service or other unintended effects due to improper memory access.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by running the command 'perf mem record' on the affected system. If the system is vulnerable, you will see a KASAN global-out-of-bounds warning similar to the following: BUG: KASAN: global-out-of-bounds in cmt_latency_data+0x176/0x1b0 Read of size 4 at addr ffffffffb721d000 by task dtlb/9850 This indicates the presence of the issue related to accessing the x86_hybrid_pmu structure on a non-hybrid platform.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update the Linux kernel to a version where the fix has been applied. The fix involves adding an is_hybrid() check before calling WARN_ON_ONCE to prevent global-out-of-bounds access. Until the update is applied, avoid running 'perf mem record' on non-hybrid platforms like CWF to prevent triggering the KASAN warning.