Cloudanix VulnDB

CVE-2025-38055

None

CVSS

—

EPSS

0.2%

Published

Jun 18, 2025

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel's performance monitoring feature can make the whole system crash when certain measurement settings are active.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Kernel NULL pointer dereference in intel_pmu_pebs_event_update_no_drain() when PEBS-via-PT bits 60/61 are misinterpreted as counter indexes during sample_freq usage instead of period, triggering page fault in NMI context.

Why it matters to the business

Potential kernel crashes and system instability on affected Linux systems using performance monitoring, resulting in denial of service with low likelihood of targeted exploitation.

How an attack unfolds

An attacker configures perf events to use PEBS-via-PT with sample frequency, generates a PMI, and triggers the unhandled NULL dereference in the PEBS drain path during interrupt handling.

How to fix it

Update the Linux kernel to include commit ca51db23166767a8445deb8331c9b8d5205d9287. For Mageia systems apply the fixed openssh package 6.6p1-5.6.mga5 if applicable to the distribution kernel.

How to confirm the fix worked

Verify kernel source contains the fix commit, reproduce the original perf PEBS-via-PT sample_freq scenario without triggering the NULL dereference, and confirm no page_fault_oops in perf/PMU paths.

Typical attack path

  1. Obtain local access or ability to run perf on target Linux system
  2. Configure perf event with PEBS-via-PT and sample_freq instead of period
  3. Trigger performance monitoring interrupt (PMI)
  4. Cause kernel NULL pointer dereference and panic in intel_pmu_drain_pebs_icl

How to detect it

Search kernel logs and crash dumps for BUG messages referencing intel_pmu_pebs_event_update_no_drain, page_fault_oops during NMI/PMI handling, or asm_exc_page_fault in the perf subsystem.

  • BUG: kernel NULL pointer dereference, address: 0000000000000195
  • intel_pmu_pebs_event_update_no_drain
  • intel_pmu_drain_pebs_icl
  • handle_pmi_common

What your security team should do

  • Prioritize kernel updates on systems using Intel PEBS performance monitoring
  • Disable sample frequency mode for PEBS-via-PT workloads until patched
  • Monitor kernel logs for perf-related NULL dereference crashes

The record

In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: Fix segfault with PEBS-via-PT with sample_freq Currently, using PEBS-via-PT with a sample frequency instead of a sample period, causes a segfault. For example: BUG: kernel NULL pointer dereference, address: 0000000000000195 <NMI> ? __die_body.cold+0x19/0x27 ? page_fault_oops+0xca/0x290 ? exc_page_fault+0x7e/0x1b0 ? asm_exc_page_fault+0x26/0x30 ? intel_pmu_pebs_event_update_no_drain+0x40/0x60 ? intel_pmu_pebs_event_update_no_drain+0x32/0x60 intel_pmu_drain_pebs_icl+0x333/0x350 handle_pmi_common+0x272/0x3c0 intel_pmu_handle_irq+0x10a/0x2e0 perf_event_nmi_handler+0x2a/0x50 That happens because intel_pmu_pebs_event_update_no_drain() assumes all the pebs_enabled bits represent counter indexes, which is not always the case. In this particular case, bits 60 and 61 are set for PEBS-via-PT purposes. The behaviour of PEBS-via-PT with sample frequency is questionable because although a PMI is generated (PEBS_PMI_AFTER_EACH_RECORD), the period is not adjusted anyway. Putting that aside, fix intel_pmu_pebs_event_update_no_drain() by passing the mask of counter bits instead of 'size'. Note, prior to the Fixes commit, 'size' would be limited to the maximum counter index, so the issue was not hit.

Affected packages

Ecosystem Package Introduced Fixed
Debian:13 linux 0 6.12.32-1
Linux Kernel 6.11.0 6.12.31

Related vulnerabilities