CVE-2025-38132

What it actually does

Race condition in coresight config allows concurrent modification of config_csdev_list during cscfg_csdev_enable_active_config and cscfg_remove_owned_csdev_configs, leading to list iteration over deleted entries without holding cscfg_csdev_lock.

Why it matters to the business

Systems using Linux coresight tracing may experience kernel instability, crashes, or undefined behavior during module load/unload or perf config activation, increasing downtime risk in affected environments.

How an attack unfolds

An attacker with local access triggers the race by enabling a perf config on one CPU while another thread loads/unloads config sets via sysfs, causing the list iteration to race with entry deletion and resulting in memory corruption or crashes.

How to fix it

Update the Linux kernel to the fixed commit 42f8afb0b161631fd1d814d017f75f955475ad41 or later stable releases containing the lock acquisition around cscfg_remove_owned_csdev_configs; for seaweedfs (Bitnami) upgrade to version 3.69.0.

How to confirm the fix worked

Verify kernel source contains the lock held during cscfg_remove_owned_csdev_configs; test by exercising perf config activation concurrent with module unload and confirm absence of list corruption or panics.

Typical attack path

1. Obtain local access on a Linux system with coresight enabled
2. Use perf to enable an active config on one CPU while triggering module load via cscfg_load_config_sets on another
3. Deactivate config and call cscfg_unload_config_sets to delete list entries
4. Trigger concurrent iteration in cscfg_csdev_enable_active_config without proper locking
5. Exploit resulting memory corruption for denial of service or further escalation

How to detect it

Review kernel logs for coresight or cscfg related oops/panics during module load and perf events; inspect for concurrent sysfs config activation and unload patterns in audit or dmesg around crash times.

What your security team should do

• Prioritize kernel upgrades on systems using coresight tracing due to race condition exposure
• Monitor for any downstream dependents in embedded or tracing-heavy deployments
• Apply fixes within standard patch cycles given low EPSS and non-KEV status
• Review threat actor mentions of related Linux kernel privilege escalations for broader context