CVE-2025-38168

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-38168", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:23.991Z", "datePublished": "2025-07-03T08:36:07.620Z", "dateUpdated": "2026-10-15T21:52:10.296Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:00:00.949Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf: arm-ni: Unregister PMUs on probe failure\n\nWhen a resource allocation fails in one clock domain of an NI device,\nwe need to properly roll back all previously registered perf PMUs in\nother clock domains of the same device.\n\nOtherwise, it can lead to kernel panics.\n\nCalling arm_ni_init+0x0/0xff8 [arm_ni] @ 2374\narm-ni ARMHCB70:00: Failed to request PMU region 0x1f3c13000\narm-ni ARMHCB70:00: probe with driver arm-ni failed with error -16\nlist_add corruption: next->prev should be prev (fffffd01e9698a18),\nbut was 0000000000000000. (next=ffff10001a0decc8).\npstate: 6340009 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)\npc : list_add_valid_or_report+0x7c/0xb8\nlr : list_add_valid_or_report+0x7c/0xb8\nCall trace:\n __list_add_valid_or_report+0x7c/0xb8\n perf_pmu_register+0x22c/0x3a0\n arm_ni_probe+0x554/0x70c [arm_ni]\n platform_probe+0x70/0xe8\n really_probe+0xc6/0x4d8\n driver_probe_device+0x48/0x170\n __driver_attach+0x8e/0x1c0\n bus_for_each_dev+0x64/0xf0\n driver_add+0x138/0x260\n bus_add_driver+0x68/0x138\n __platform_driver_register+0x2c/0x40\n arm_ni_init+0x14/0x2a [arm_ni]\n do_init_module+0x36/0x298\n---[ end trace 0000000000000000 ]---\nKernel panic - not syncing: Oops - BUG: Fatal exception\nSMP: stopping secondary CPUs"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is in an arm64 platform PMU driver's probe path and the resulting dangling `struct pmu` is exercised through local interfaces \u2014 `perf_event_open(2)` and `/sys/bus/event_source/devices/` \u2014 with no network or remote-peer input involved. Physical access is not required since the driver binds from firmware-described ACPI/DT platform devices.\nAC:L - On an affected system the probe failure is deterministic and repeatable (the overlapping PMU region fails identically on every load), and the resulting dangling PMU persists in the global `pmus` list, so the attacker's follow-on `perf_event_open()`/sysfs access is fully under their control and can be retried indefinitely to win any heap-reallocation attempt.\nPR:L - The dangling-PMU state is created by the kernel itself during boot-time probe with no attacker involvement, and reaching the freed object afterwards requires only an unprivileged local account \u2014 `perf_event_open()` walks the `pmus` list before any `perf_event_paranoid` check, and the PMU sysfs attributes are world-readable at mode 0444.\nUI:N - No victim action is needed; the vulnerable state arises automatically when the driver probes at boot or on module autoload, and the attacker triggers the use-after-free with a plain syscall or sysfs read.\nS:U - The freed memory, the corrupted list, and the hijackable function pointers are all kernel-resident, so the impact stays within the kernel's own security authority with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - The registered PMUs outlive the `devm_kzalloc()`'d `struct arm_ni` that embeds them, so the world-readable `arm_ni_cpumask_show`/format/identifier attributes dereference freed slab memory via `pmu_to_cd()`/`cd_to_ni()`, disclosing whatever data has since been reallocated into that chunk.\nI:H - This is a use-after-free on a `struct pmu` whose ops table is invoked from `perf_init_event()` \u2014 spraying the reclaimed devres allocation gives an attacker-controlled `pmu->event_init` indirect call and thus kernel control-flow hijack, and the stale `list_head` additionally causes writes through a freed pointer.\nA:H - The commit message documents the actual observed result: `list_add` corruption in `perf_pmu_register()` leading to `Kernel panic - not syncing: Oops - BUG: Fatal exception` with secondary CPUs stopped, a complete system denial of service."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/perf/arm-ni.c"], "versions": [{"version": "4d5a7680f2b4d0c2955e1d9f9a594b050d637436", "lessThan": "7e958e116e3be05a1f869b5a885fc5d674c7725f", "status": "affected", "versionType": "git"}, {"version": "4d5a7680f2b4d0c2955e1d9f9a594b050d637436", "lessThan": "72caf9886e9c1731cf7bfe3eabc308b9268b21d6", "status": "affected", "versionType": "git"}, {"version": "4d5a7680f2b4d0c2955e1d9f9a594b050d637436", "lessThan": "7f57afde6a44d9e044885e1125034edd4fda02e8", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/perf/arm-ni.c"], "versions": [{"version": "6.12", "status": "affected"}, {"version": "0", "lessThan": "6.12", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.34", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.15.3", "lessThanOrEqual": "6.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.16", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.12.34"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.15.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.16"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/7e958e116e3be05a1f869b5a885fc5d674c7725f"}, {"url": "https://git.kernel.org/stable/c/72caf9886e9c1731cf7bfe3eabc308b9268b21d6"}, {"url": "https://git.kernel.org/stable/c/7f57afde6a44d9e044885e1125034edd4fda02e8"}], "title": "perf: arm-ni: Unregister PMUs on probe failure", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-38168", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:48:06.926164Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:52:10.296Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-38168", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:48:06.926164Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:48:07.811Z"}}], "cna": {"title": "perf: arm-ni: Unregister PMUs on probe failure", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is in an arm64 platform PMU driver's probe path and the resulting dangling `struct pmu` is exercised through local interfaces \u2014 `perf_event_open(2)` and `/sys/bus/event_source/devices/` \u2014 with no network or remote-peer input involved. Physical access is not required since the driver binds from firmware-described ACPI/DT platform devices.\nAC:L - On an affected system the probe failure is deterministic and repeatable (the overlapping PMU region fails identically on every load), and the resulting dangling PMU persists in the global `pmus` list, so the attacker's follow-on `perf_event_open()`/sysfs access is fully under their control and can be retried indefinitely to win any heap-reallocation attempt.\nPR:L - The dangling-PMU state is created by the kernel itself during boot-time probe with no attacker involvement, and reaching the freed object afterwards requires only an unprivileged local account \u2014 `perf_event_open()` walks the `pmus` list before any `perf_event_paranoid` check, and the PMU sysfs attributes are world-readable at mode 0444.\nUI:N - No victim action is needed; the vulnerable state arises automatically when the driver probes at boot or on module autoload, and the attacker triggers the use-after-free with a plain syscall or sysfs read.\nS:U - The freed memory, the corrupted list, and the hijackable function pointers are all kernel-resident, so the impact stays within the kernel's own security authority with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - The registered PMUs outlive the `devm_kzalloc()`'d `struct arm_ni` that embeds them, so the world-readable `arm_ni_cpumask_show`/format/identifier attributes dereference freed slab memory via `pmu_to_cd()`/`cd_to_ni()`, disclosing whatever data has since been reallocated into that chunk.\nI:H - This is a use-after-free on a `struct pmu` whose ops table is invoked from `perf_init_event()` \u2014 spraying the reclaimed devres allocation gives an attacker-controlled `pmu->event_init` indirect call and thus kernel control-flow hijack, and the stale `list_head` additionally causes writes through a freed pointer.\nA:H - The commit message documents the actual observed result: `list_add` corruption in `perf_pmu_register()` leading to `Kernel panic - not syncing: Oops - BUG: Fatal exception` with secondary CPUs stopped, a complete system denial of service."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4d5a7680f2b4d0c2955e1d9f9a594b050d637436", "lessThan": "7e958e116e3be05a1f869b5a885fc5d674c7725f", "versionType": "git"}, {"status": "affected", "version": "4d5a7680f2b4d0c2955e1d9f9a594b050d637436", "lessThan": "72caf9886e9c1731cf7bfe3eabc308b9268b21d6", "versionType": "git"}, {"status": "affected", "version": "4d5a7680f2b4d0c2955e1d9f9a594b050d637436", "lessThan": "7f57afde6a44d9e044885e1125034edd4fda02e8", "versionType": "git"}], "programFiles": ["drivers/perf/arm-ni.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.12"}, {"status": "unaffected", "version": "0", "lessThan": "6.12", "versionType": "semver"}, {"status": "unaffected", "version": "6.12.34", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.15.3", "versionType": "semver", "lessThanOrEqual": "6.15.*"}, {"status": "unaffected", "version": "6.16", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/perf/arm-ni.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/7e958e116e3be05a1f869b5a885fc5d674c7725f"}, {"url": "https://git.kernel.org/stable/c/72caf9886e9c1731cf7bfe3eabc308b9268b21d6"}, {"url": "https://git.kernel.org/stable/c/7f57afde6a44d9e044885e1125034edd4fda02e8"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf: arm-ni: Unregister PMUs on probe failure\n\nWhen a resource allocation fails in one clock domain of an NI device,\nwe need to properly roll back all previously registered perf PMUs in\nother clock domains of the same device.\n\nOtherwise, it can lead to kernel panics.\n\nCalling arm_ni_init+0x0/0xff8 [arm_ni] @ 2374\narm-ni ARMHCB70:00: Failed to request PMU region 0x1f3c13000\narm-ni ARMHCB70:00: probe with driver arm-ni failed with error -16\nlist_add corruption: next->prev should be prev (fffffd01e9698a18),\nbut was 0000000000000000. (next=ffff10001a0decc8).\npstate: 6340009 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)\npc : list_add_valid_or_report+0x7c/0xb8\nlr : list_add_valid_or_report+0x7c/0xb8\nCall trace:\n __list_add_valid_or_report+0x7c/0xb8\n perf_pmu_register+0x22c/0x3a0\n arm_ni_probe+0x554/0x70c [arm_ni]\n platform_probe+0x70/0xe8\n really_probe+0xc6/0x4d8\n driver_probe_device+0x48/0x170\n __driver_attach+0x8e/0x1c0\n bus_for_each_dev+0x64/0xf0\n driver_add+0x138/0x260\n bus_add_driver+0x68/0x138\n __platform_driver_register+0x2c/0x40\n arm_ni_init+0x14/0x2a [arm_ni]\n do_init_module+0x36/0x298\n---[ end trace 0000000000000000 ]---\nKernel panic - not syncing: Oops - BUG: Fatal exception\nSMP: stopping secondary CPUs"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.34", "versionStartIncluding": "6.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.15.3", "versionStartIncluding": "6.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.16", "versionStartIncluding": "6.12"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:00:00.949Z"}}}, "cveMetadata": {"cveId": "CVE-2025-38168", "state": "PUBLISHED", "dateUpdated": "2026-10-15T21:52:10.296Z", "dateReserved": "2025-04-16T04:51:23.991Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-07-03T08:36:07.620Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/perf/arm-ni.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "7e958e116e3be05a1f869b5a885fc5d674c7725f", "status": "affected", "version": "4d5a7680f2b4d0c2955e1d9f9a594b050d637436", "versionType": "git"}, {"lessThan": "72caf9886e9c1731cf7bfe3eabc308b9268b21d6", "status": "affected", "version": "4d5a7680f2b4d0c2955e1d9f9a594b050d637436", "versionType": "git"}, {"lessThan": "7f57afde6a44d9e044885e1125034edd4fda02e8", "status": "affected", "version": "4d5a7680f2b4d0c2955e1d9f9a594b050d637436", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/perf/arm-ni.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.12"}, {"lessThan": "6.12", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.34", "versionType": "semver"}, {"lessThanOrEqual": "6.15.*", "status": "unaffected", "version": "6.15.3", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.16", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D349613A-2E37-4539-B97E-D97F5D92A03C", "versionEndExcluding": "6.12.34", "versionStartIncluding": "6.12", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0541C761-BD5E-4C1A-8432-83B375D7EB92", "versionEndExcluding": "6.15.3", "versionStartIncluding": "6.13", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf: arm-ni: Unregister PMUs on probe failure\n\nWhen a resource allocation fails in one clock domain of an NI device,\nwe need to properly roll back all previously registered perf PMUs in\nother clock domains of the same device.\n\nOtherwise, it can lead to kernel panics.\n\nCalling arm_ni_init+0x0/0xff8 [arm_ni] @ 2374\narm-ni ARMHCB70:00: Failed to request PMU region 0x1f3c13000\narm-ni ARMHCB70:00: probe with driver arm-ni failed with error -16\nlist_add corruption: next->prev should be prev (fffffd01e9698a18),\nbut was 0000000000000000. (next=ffff10001a0decc8).\npstate: 6340009 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)\npc : list_add_valid_or_report+0x7c/0xb8\nlr : list_add_valid_or_report+0x7c/0xb8\nCall trace:\n __list_add_valid_or_report+0x7c/0xb8\n perf_pmu_register+0x22c/0x3a0\n arm_ni_probe+0x554/0x70c [arm_ni]\n platform_probe+0x70/0xe8\n really_probe+0xc6/0x4d8\n driver_probe_device+0x48/0x170\n __driver_attach+0x8e/0x1c0\n bus_for_each_dev+0x64/0xf0\n driver_add+0x138/0x260\n bus_add_driver+0x68/0x138\n __platform_driver_register+0x2c/0x40\n arm_ni_init+0x14/0x2a [arm_ni]\n do_init_module+0x36/0x298\n---[ end trace 0000000000000000 ]---\nKernel panic - not syncing: Oops - BUG: Fatal exception\nSMP: stopping secondary CPUs"}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: perf: arm-ni: Anular el registro de las PMU en caso de fallo de la sonda. Cuando falla la asignaci\u00f3n de recursos en un dominio de reloj de un dispositivo NI, es necesario revertir correctamente todas las PMU de perf registradas previamente en otros dominios de reloj del mismo dispositivo. De lo contrario, puede provocar p\u00e1nicos del kernel. Llamada a arm_ni_init+0x0/0xff8 [arm_ni] a 2374 arm-ni ARMHCB70:00: Error al solicitar la regi\u00f3n de PMU 0x1f3c13000 arm-ni ARMHCB70:00: La sonda con el controlador arm-ni fall\u00f3 con el error -16. Corrupci\u00f3n de list_add: next->prev deber\u00eda ser prev (ffffffd01e9698a18), pero era 0000000000000000. (next=ffff10001a0decc8). pstate: 6340009 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) pc : list_add_valid_or_report+0x7c/0xb8 lr : list_add_valid_or_report+0x7c/0xb8 Call trace: __list_add_valid_or_report+0x7c/0xb8 perf_pmu_register+0x22c/0x3a0 arm_ni_probe+0x554/0x70c [arm_ni] platform_probe+0x70/0xe8 really_probe+0xc6/0x4d8 driver_probe_device+0x48/0x170 __driver_attach+0x8e/0x1c0 bus_for_each_dev+0x64/0xf0 driver_add+0x138/0x260 bus_add_driver+0x68/0x138 __platform_driver_register+0x2c/0x40 arm_ni_init+0x14/0x2a [arm_ni] do_init_module+0x36/0x298 ---[ fin de seguimiento 000000000000000 ]--- P\u00e1nico del kernel - no sincroniza: Ups - ERROR: Excepci\u00f3n fatal SMP: deteniendo las CPU secundarias"}], "id": "CVE-2025-38168", "lastModified": "2026-10-15T22:18:32.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-38168", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:48:06.926164Z", "version": "2.0.3"}}]}, "published": "2025-07-03T09:15:32.377", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/72caf9886e9c1731cf7bfe3eabc308b9268b21d6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7e958e116e3be05a1f869b5a885fc5d674c7725f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7f57afde6a44d9e044885e1125034edd4fda02e8"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: perf: arm-ni: Unregister PMUs on probe failure", "id": "2376079", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2376079"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nperf: arm-ni: Unregister PMUs on probe failure\nWhen a resource allocation fails in one clock domain of an NI device,\nwe need to properly roll back all previously registered perf PMUs in\nother clock domains of the same device.\nOtherwise, it can lead to kernel panics.\nCalling arm_ni_init+0x0/0xff8 [arm_ni] @ 2374\narm-ni ARMHCB70:00: Failed to request PMU region 0x1f3c13000\narm-ni ARMHCB70:00: probe with driver arm-ni failed with error -16\nlist_add corruption: next->prev should be prev (fffffd01e9698a18),\nbut was 0000000000000000. (next=ffff10001a0decc8).\npstate: 6340009 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)\npc : list_add_valid_or_report+0x7c/0xb8\nlr : list_add_valid_or_report+0x7c/0xb8\nCall trace:\n__list_add_valid_or_report+0x7c/0xb8\nperf_pmu_register+0x22c/0x3a0\narm_ni_probe+0x554/0x70c [arm_ni]\nplatform_probe+0x70/0xe8\nreally_probe+0xc6/0x4d8\ndriver_probe_device+0x48/0x170\n__driver_attach+0x8e/0x1c0\nbus_for_each_dev+0x64/0xf0\ndriver_add+0x138/0x260\nbus_add_driver+0x68/0x138\n__platform_driver_register+0x2c/0x40\narm_ni_init+0x14/0x2a [arm_ni]\ndo_init_module+0x36/0x298\n---[ end trace 0000000000000000 ]---\nKernel panic - not syncing: Oops - BUG: Fatal exception\nSMP: stopping secondary CPUs"], "name": "CVE-2025-38168", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-07-03T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-38168\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-38168\nhttps://lore.kernel.org/linux-cve-announce/2025070341-CVE-2025-38168-da4f@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-07-06T22:16:23.375154+00:00", "updated": "2025-07-06T22:16:23.375211+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}