CVE-2025-38563

What it actually does

The flaw allows VMA splits via mmap/munmap/mremap on perf ringbuffer and auxiliary buffer mappings, bypassing offset/size checks and causing unpaired perf_mmap_open() reference count increments without corresponding decrements in perf_mmap_close().

Why it matters to the business

Kernel memory accounting leaks in performance monitoring subsystems can lead to gradual resource exhaustion on systems using perf, increasing operational risk for monitoring-heavy workloads and container environments; urgency is elevated by listed active exploitation campaigns and Linux kernel privilege escalation activity.

How an attack unfolds

An attacker with the ability to invoke perf event mmap operations uses targeted mmap(2), munmap(2), or mremap(2) calls to split the initial VMA of the ringbuffer or auxiliary buffer mapping. This triggers repeated perf_mmap_open() calls that acquire references while subsequent perf_mmap_close() calls fail the size/offset validation, leaking references. Threat actors associated with Advanced Spyware Campaign, Linux Kernel Privilege Escalation in Container-Optimized OS, and September 2025 Active Exploitation Campaigns have been observed targeting similar Linux kernel memory issues.

How to fix it

Upgrade affected Linux kernel installations to commit e4346ffec2c44d6b0be834d59b20632b5bb5729e or later. For listed Chainguard packages, update to version 0.53.0-r0 or newer. Rebuild and redeploy any containers or systems depending on the vulnerable kernel or packages.

How to confirm the fix worked

Confirm the running kernel contains commit e4346ffec2c44d6b0be834d59b20632b5bb5729e; verify package versions match the fixed Chainguard releases; test that attempts to split perf buffer VMAs now return -EINVAL via the may_split callback.

Typical attack path

1. Obtain ability to create perf events and perform mmap on ringbuffer/auxiliary buffers
2. Issue mmap/munmap/mremap sequences that split the established VMA while preserving partial mappings
3. Trigger repeated open/close cycles that bypass reference accounting checks
4. Accumulate leaked kernel references leading to memory pressure or follow-on corruption

How to detect it

Review kernel audit logs and perf-related syscalls for unusual sequences of mmap, munmap, and mremap operations on perf buffers; correlate with reference count warnings or memory pressure events in dmesg; look for activity patterns matching known Linux kernel privilege escalation campaigns.

What your security team should do

• Prioritize kernel and package upgrades on all systems exposing perf to untrusted workloads, especially containers
• Monitor EPSS trend and threat actor activity for rapid increase in exploitation likelihood
• Restrict perf event creation to privileged users via sysctl or seccomp where feasible
• Audit container images for the listed openjdk-21-openj9 variants and rebuild with fixed versions