CVE-2025-38322

What it actually does

The vulnerability causes a general protection fault and hard lockup when icl_update_topdown_event() invokes native_read_pmc on Intel E-core CPUs lacking perf metrics support, due to a regression that incorrectly uses is_topdown_event() instead of is_topdown_count().

Why it matters to the business

Affected Linux systems on Raptor Lake and similar Intel hardware experience kernel crashes and reboots during performance monitoring, resulting in unplanned downtime, service interruptions, and potential data corruption across widely deployed server and workstation fleets.

How an attack unfolds

An attacker or automated fuzzer with local access triggers perf event sampling of topdown metrics; on E-core CPUs the missing guard allows execution of unsupported PMC reads, producing the fault and lockup.

How to fix it

Upgrade the Linux kernel to a fixed release (6.1.149 or newer, 6.6.58-r0 for Alpaquita linux-lts) or apply commit 702ea6028032d6c1fe96c2d4762a3575e3654819; reboot after installation.

How to confirm the fix worked

Confirm the running kernel contains the listed fix commit or version string, then exercise perf topdown monitoring on E-core CPUs and verify absence of oops or lockups in dmesg.

Typical attack path

1. Obtain local user or root access on a vulnerable system
2. Invoke perf or equivalent API to create topdown events
3. Schedule or migrate the workload onto an E-core CPU
4. Trigger event read path leading to native_read_pmc fault

How to detect it

Search kernel logs and dmesg for general protection faults originating from native_read_pmc or icl_update_topdown_event on Raptor Lake hardware during perf activity; correlate with swapper or perf process contexts.

• Oops: general protection fault
• native_read_pmc+0x7/0x40
• icl_update_topdown_event+0x165/0x190
• Hardware name: Dell Inc. Precision 9660
• Tainted: [W]=WARN

What your security team should do

• Apply kernel updates within the next maintenance window on all Raptor Lake and similar Intel hosts
• Temporarily restrict unprivileged perf access via sysctl until patches are deployed
• Add kernel oops and perf-related crash signatures to alerting rules