In the Linux kernel, the following vulnerability has been resolved:
perf: Fix sample vs do_exit()
Baisheng Gao reported an ARM64 crash, which Mark decoded as being a synchronous external abort -- most likely due to trying to access MMIO in bad ways.
The crash further shows perf trying to do a user stack sample while in exitmmap()'s tlbfinish_mmu() -- i.e. while tearing down the address space it is trying to access.
It turns out that we stop perf after we tear down the userspace mm; a receipie for disaster, since perf likes to access userspace for various reasons.
Flip this order by moving up where we stop perf in do_exit().
Additionally, harden PERFSAMPLECALLCHAIN and PERFSAMPLESTACKUSER to abort when the current task does not have an mm (exitmm() makes sure to set current->mm = NULL; before commencing with the actual teardown). Such that CPU wide events don't trip on this same problem.
[
{
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@975ffddfa2e19823c719459d2364fcaa17673964",
"digest": {
"line_hashes": [
"285714079123593492509530916371439983434",
"113502440038515659335296696224845221353",
"124823267379127287307309410134189467923",
"154503393308000053779451440013939871731",
"133248442527605856966724243490397614792",
"297404225167689225189115850902130296534",
"88985859324003047847783009437454663488"
],
"threshold": 0.9
},
"id": "CVE-2025-38424-013ae22c",
"deprecated": false,
"target": {
"file": "kernel/exit.c"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@975ffddfa2e19823c719459d2364fcaa17673964",
"digest": {
"length": 405.0,
"function_hash": "288717927296554446605216933603355944871"
},
"id": "CVE-2025-38424-04d5822e",
"deprecated": false,
"target": {
"file": "kernel/events/core.c",
"function": "perf_sample_ustack_size"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b8f3c72175c6a63a95cf2e219f8b78e2baad34e",
"digest": {
"length": 405.0,
"function_hash": "288717927296554446605216933603355944871"
},
"id": "CVE-2025-38424-093df6af",
"deprecated": false,
"target": {
"file": "kernel/events/core.c",
"function": "perf_sample_ustack_size"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4f6fc782128355931527cefe3eb45338abd8ab39",
"digest": {
"length": 405.0,
"function_hash": "288717927296554446605216933603355944871"
},
"id": "CVE-2025-38424-0e2bd684",
"deprecated": false,
"target": {
"file": "kernel/events/core.c",
"function": "perf_sample_ustack_size"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a9f6aab7910a0ef2895797f15c947f6d1053160f",
"digest": {
"length": 2224.0,
"function_hash": "271561395722242866925127279594966359959"
},
"id": "CVE-2025-38424-0e640886",
"deprecated": false,
"target": {
"file": "kernel/exit.c",
"function": "do_exit"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@456019adaa2f5366b89c868dea9b483179bece54",
"digest": {
"line_hashes": [
"285714079123593492509530916371439983434",
"113502440038515659335296696224845221353",
"124823267379127287307309410134189467923",
"154503393308000053779451440013939871731",
"133248442527605856966724243490397614792",
"297404225167689225189115850902130296534",
"88985859324003047847783009437454663488"
],
"threshold": 0.9
},
"id": "CVE-2025-38424-1bda691e",
"deprecated": false,
"target": {
"file": "kernel/exit.c"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@975ffddfa2e19823c719459d2364fcaa17673964",
"digest": {
"length": 1759.0,
"function_hash": "203400401160491846493949578486526611810"
},
"id": "CVE-2025-38424-2cadba39",
"deprecated": false,
"target": {
"file": "kernel/exit.c",
"function": "do_exit"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@507c9a595bad3abd107c6a8857d7fd125d89f386",
"digest": {
"length": 453.0,
"function_hash": "324792508994022473578805582368313480221"
},
"id": "CVE-2025-38424-30a39fab",
"deprecated": false,
"target": {
"file": "kernel/events/core.c",
"function": "perf_callchain"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@507c9a595bad3abd107c6a8857d7fd125d89f386",
"digest": {
"length": 2224.0,
"function_hash": "271561395722242866925127279594966359959"
},
"id": "CVE-2025-38424-3b70c955",
"deprecated": false,
"target": {
"file": "kernel/exit.c",
"function": "do_exit"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7311970d07c4606362081250da95f2c7901fc0db",
"digest": {
"line_hashes": [
"309764108017450696891302544512752663494",
"255962189404313696804278869151878725288",
"29622739599068677847692095215175595519",
"135868285825759498635893649828812511655",
"96243746542728600356835471852419015206",
"164828775616245365977552653571499302702"
],
"threshold": 0.9
},
"id": "CVE-2025-38424-4372b360",
"deprecated": false,
"target": {
"file": "kernel/events/core.c"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a9f6aab7910a0ef2895797f15c947f6d1053160f",
"digest": {
"length": 405.0,
"function_hash": "288717927296554446605216933603355944871"
},
"id": "CVE-2025-38424-44e0a25c",
"deprecated": false,
"target": {
"file": "kernel/events/core.c",
"function": "perf_sample_ustack_size"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4f6fc782128355931527cefe3eb45338abd8ab39",
"digest": {
"line_hashes": [
"309764108017450696891302544512752663494",
"255962189404313696804278869151878725288",
"29622739599068677847692095215175595519",
"135868285825759498635893649828812511655",
"96243746542728600356835471852419015206",
"164828775616245365977552653571499302702"
],
"threshold": 0.9
},
"id": "CVE-2025-38424-45695346",
"deprecated": false,
"target": {
"file": "kernel/events/core.c"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@456019adaa2f5366b89c868dea9b483179bece54",
"digest": {
"length": 453.0,
"function_hash": "324792508994022473578805582368313480221"
},
"id": "CVE-2025-38424-487417ce",
"deprecated": false,
"target": {
"file": "kernel/events/core.c",
"function": "perf_callchain"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a9f6aab7910a0ef2895797f15c947f6d1053160f",
"digest": {
"length": 453.0,
"function_hash": "324792508994022473578805582368313480221"
},
"id": "CVE-2025-38424-4d561278",
"deprecated": false,
"target": {
"file": "kernel/events/core.c",
"function": "perf_callchain"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7311970d07c4606362081250da95f2c7901fc0db",
"digest": {
"line_hashes": [
"285714079123593492509530916371439983434",
"113502440038515659335296696224845221353",
"124823267379127287307309410134189467923",
"154503393308000053779451440013939871731",
"133248442527605856966724243490397614792",
"297404225167689225189115850902130296534",
"88985859324003047847783009437454663488"
],
"threshold": 0.9
},
"id": "CVE-2025-38424-4dfb8576",
"deprecated": false,
"target": {
"file": "kernel/exit.c"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b8f3c72175c6a63a95cf2e219f8b78e2baad34e",
"digest": {
"line_hashes": [
"309764108017450696891302544512752663494",
"255962189404313696804278869151878725288",
"29622739599068677847692095215175595519",
"135868285825759498635893649828812511655",
"96243746542728600356835471852419015206",
"164828775616245365977552653571499302702"
],
"threshold": 0.9
},
"id": "CVE-2025-38424-51e78cde",
"deprecated": false,
"target": {
"file": "kernel/events/core.c"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b8f3c72175c6a63a95cf2e219f8b78e2baad34e",
"digest": {
"length": 2246.0,
"function_hash": "246802154440372458289281181158874643870"
},
"id": "CVE-2025-38424-6ec36073",
"deprecated": false,
"target": {
"file": "kernel/exit.c",
"function": "do_exit"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@507c9a595bad3abd107c6a8857d7fd125d89f386",
"digest": {
"length": 405.0,
"function_hash": "288717927296554446605216933603355944871"
},
"id": "CVE-2025-38424-73ca73b6",
"deprecated": false,
"target": {
"file": "kernel/events/core.c",
"function": "perf_sample_ustack_size"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@507c9a595bad3abd107c6a8857d7fd125d89f386",
"digest": {
"line_hashes": [
"309764108017450696891302544512752663494",
"255962189404313696804278869151878725288",
"29622739599068677847692095215175595519",
"135868285825759498635893649828812511655",
"96243746542728600356835471852419015206",
"164828775616245365977552653571499302702"
],
"threshold": 0.9
},
"id": "CVE-2025-38424-8171387a",
"deprecated": false,
"target": {
"file": "kernel/events/core.c"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a9f6aab7910a0ef2895797f15c947f6d1053160f",
"digest": {
"line_hashes": [
"309764108017450696891302544512752663494",
"255962189404313696804278869151878725288",
"29622739599068677847692095215175595519",
"135868285825759498635893649828812511655",
"96243746542728600356835471852419015206",
"164828775616245365977552653571499302702"
],
"threshold": 0.9
},
"id": "CVE-2025-38424-817b2fe5",
"deprecated": false,
"target": {
"file": "kernel/events/core.c"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@456019adaa2f5366b89c868dea9b483179bece54",
"digest": {
"length": 1717.0,
"function_hash": "163703085004349916318604158346420907998"
},
"id": "CVE-2025-38424-83eb9d94",
"deprecated": false,
"target": {
"file": "kernel/exit.c",
"function": "do_exit"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7311970d07c4606362081250da95f2c7901fc0db",
"digest": {
"length": 1717.0,
"function_hash": "163703085004349916318604158346420907998"
},
"id": "CVE-2025-38424-851d332b",
"deprecated": false,
"target": {
"file": "kernel/exit.c",
"function": "do_exit"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@975ffddfa2e19823c719459d2364fcaa17673964",
"digest": {
"length": 453.0,
"function_hash": "324792508994022473578805582368313480221"
},
"id": "CVE-2025-38424-a32ad99b",
"deprecated": false,
"target": {
"file": "kernel/events/core.c",
"function": "perf_callchain"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7311970d07c4606362081250da95f2c7901fc0db",
"digest": {
"length": 405.0,
"function_hash": "288717927296554446605216933603355944871"
},
"id": "CVE-2025-38424-b74e8654",
"deprecated": false,
"target": {
"file": "kernel/events/core.c",
"function": "perf_sample_ustack_size"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4f6fc782128355931527cefe3eb45338abd8ab39",
"digest": {
"line_hashes": [
"315749629880372164189734279247555012752",
"234168884112701458115497472600549376201",
"272305673064681007932641518640880680716",
"154503393308000053779451440013939871731",
"133248442527605856966724243490397614792",
"297404225167689225189115850902130296534",
"88985859324003047847783009437454663488"
],
"threshold": 0.9
},
"id": "CVE-2025-38424-b7ebbbb8",
"deprecated": false,
"target": {
"file": "kernel/exit.c"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4f6fc782128355931527cefe3eb45338abd8ab39",
"digest": {
"length": 1723.0,
"function_hash": "8073248452982471708302701944561192297"
},
"id": "CVE-2025-38424-c3ccdfec",
"deprecated": false,
"target": {
"file": "kernel/exit.c",
"function": "do_exit"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@507c9a595bad3abd107c6a8857d7fd125d89f386",
"digest": {
"line_hashes": [
"285714079123593492509530916371439983434",
"113502440038515659335296696224845221353",
"124823267379127287307309410134189467923",
"154503393308000053779451440013939871731",
"133248442527605856966724243490397614792",
"297404225167689225189115850902130296534",
"88985859324003047847783009437454663488"
],
"threshold": 0.9
},
"id": "CVE-2025-38424-c3fc8820",
"deprecated": false,
"target": {
"file": "kernel/exit.c"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4f6fc782128355931527cefe3eb45338abd8ab39",
"digest": {
"length": 453.0,
"function_hash": "324792508994022473578805582368313480221"
},
"id": "CVE-2025-38424-ca3f39b6",
"deprecated": false,
"target": {
"file": "kernel/events/core.c",
"function": "perf_callchain"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@456019adaa2f5366b89c868dea9b483179bece54",
"digest": {
"line_hashes": [
"309764108017450696891302544512752663494",
"255962189404313696804278869151878725288",
"29622739599068677847692095215175595519",
"135868285825759498635893649828812511655",
"96243746542728600356835471852419015206",
"164828775616245365977552653571499302702"
],
"threshold": 0.9
},
"id": "CVE-2025-38424-d703d613",
"deprecated": false,
"target": {
"file": "kernel/events/core.c"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@456019adaa2f5366b89c868dea9b483179bece54",
"digest": {
"length": 405.0,
"function_hash": "288717927296554446605216933603355944871"
},
"id": "CVE-2025-38424-db0b6686",
"deprecated": false,
"target": {
"file": "kernel/events/core.c",
"function": "perf_sample_ustack_size"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b8f3c72175c6a63a95cf2e219f8b78e2baad34e",
"digest": {
"line_hashes": [
"285714079123593492509530916371439983434",
"113502440038515659335296696224845221353",
"124823267379127287307309410134189467923",
"155399567571756463576005579559597698341",
"103286570425511861131083945323954749264",
"205463133757609522877635128239336349720",
"88985859324003047847783009437454663488"
],
"threshold": 0.9
},
"id": "CVE-2025-38424-df32d2c4",
"deprecated": false,
"target": {
"file": "kernel/exit.c"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a9f6aab7910a0ef2895797f15c947f6d1053160f",
"digest": {
"line_hashes": [
"285714079123593492509530916371439983434",
"113502440038515659335296696224845221353",
"124823267379127287307309410134189467923",
"154503393308000053779451440013939871731",
"133248442527605856966724243490397614792",
"297404225167689225189115850902130296534",
"88985859324003047847783009437454663488"
],
"threshold": 0.9
},
"id": "CVE-2025-38424-e91a220e",
"deprecated": false,
"target": {
"file": "kernel/exit.c"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@975ffddfa2e19823c719459d2364fcaa17673964",
"digest": {
"line_hashes": [
"309764108017450696891302544512752663494",
"255962189404313696804278869151878725288",
"29622739599068677847692095215175595519",
"135868285825759498635893649828812511655",
"96243746542728600356835471852419015206",
"164828775616245365977552653571499302702"
],
"threshold": 0.9
},
"id": "CVE-2025-38424-e9887cda",
"deprecated": false,
"target": {
"file": "kernel/events/core.c"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7311970d07c4606362081250da95f2c7901fc0db",
"digest": {
"length": 453.0,
"function_hash": "324792508994022473578805582368313480221"
},
"id": "CVE-2025-38424-f070ddb8",
"deprecated": false,
"target": {
"file": "kernel/events/core.c",
"function": "perf_callchain"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b8f3c72175c6a63a95cf2e219f8b78e2baad34e",
"digest": {
"length": 453.0,
"function_hash": "324792508994022473578805582368313480221"
},
"id": "CVE-2025-38424-f4b2b162",
"deprecated": false,
"target": {
"file": "kernel/events/core.c",
"function": "perf_callchain"
}
}
]