CVE-2025-38565

What it actually does

perf_mmap() failure path on X86 invokes event_mapped() and increments perf_rdpmc_allowed without a matching decrement because perf_mmap_close() is never reached, producing a permanent reference count leak.

Why it matters to the business

Long-running or containerized Linux workloads can accumulate leaked references, eventually exhausting the counter and impairing performance monitoring or enabling follow-on kernel abuse in high-density environments.

How an attack unfolds

An attacker repeatedly forces perf_mmap() allocation failures for events that register the X86 rdpmc callback; each failure leaks a reference while the counter is never decremented, allowing the attacker to drive the counter past its intended limit and combine the state with other kernel primitives for privilege escalation, as observed in Container-Optimized OS campaigns.

How to fix it

Update the Linux kernel to commit 5ffda7f3ed76ec8defc19d985e33b3b82ba07839 or later; for affected Chainguard packages apply openjdk-11-openj9 0.53.0-r0 or newer. Reboot systems after kernel updates and verify the running kernel contains the fix.

How to confirm the fix worked

Confirm the running kernel contains commit 5ffda7f3ed76ec8defc19d985e33b3b82ba07839 via uname or /proc/version; on Chainguard images verify package versions match the listed fixed releases; inspect perf_event code for the early-return guard on perf_mmap failure.

Typical attack path

1. Obtain ability to create perf events (unprivileged or container context)
2. Trigger repeated perf_mmap() calls that deliberately fail allocation
3. Observe or wait for perf_rdpmc_allowed counter to leak upward
4. Combine leaked state with additional kernel bugs to obtain elevated privileges

How to detect it

Review kernel audit logs and perf-related syscalls for repeated mmap failures on perf_event_open; look for anomalous increments of rdpmc usage counters via /proc or eBPF; correlate with known container escape or privilege-escalation sequences reported against Container-Optimized OS.

What your security team should do

• Apply the kernel and package updates within normal change windows; treat as higher priority on container hosts and multi-tenant systems
• Audit perf_event usage policies and restrict unprivileged perf access via sysctl kernel.perf_event_paranoid where feasible
• Monitor EPSS trend and any new exploit artifacts; re-evaluate if the score rises above 0.01