CVE-2025-40359

What it actually does

Out-of-bounds memory read in the perf/x86/intel subsystem when setup_arch_pebs_sample_data calls cmt_latency_data without verifying the PMU is hybrid, dereferencing a non-existent x86_hybrid_pmu structure on non-hybrid platforms.

Why it matters to the business

Kernel instability, crashes, or potential information disclosure when administrators run performance monitoring commands such as perf mem record on affected x86 systems; widespread impact due to presence in the Linux kernel across many distributions and cloud environments.

How an attack unfolds

An attacker with local access executes the perf mem record command or triggers PEBS sampling on a non-hybrid Intel CPU; the missing is_hybrid() guard causes the kernel to access invalid global memory in __grt_latency_data, producing a KASAN out-of-bounds read during PMI handling.

How to fix it

Upgrade the Linux kernel to a version containing commit 1b61a1da3d8105ea1be548c94c2856697eb7ffd1 or later; rebuild and reboot with the patched kernel; for Red Hat OpenShift 4.4 deployments update containernetworking-plugins packages to 0:0.8.6-1.rhaos4.4.el7 or 0:0.8.6-1.rhaos4.4.el8 as applicable.

How to confirm the fix worked

Confirm the running kernel contains the fix commit; re-run perf mem record on the previously affected non-hybrid hardware and verify absence of the KASAN global-out-of-bounds warning in dmesg or kernel logs.

Typical attack path

1. Obtain local execution on a non-hybrid x86 platform
2. Run perf mem record or equivalent PEBS sampling workload
3. Trigger intel_pmu_drain_arch_pebs path that reaches cmt_latency_data
4. Read past the end of the global array, potentially leaking kernel memory or causing a fault

How to detect it

Search kernel logs and dmesg for KASAN reports mentioning cmt_latency_data, setup_arch_pebs_sample_data, or global-out-of-bounds accesses during perf or PMI handling; correlate with execution of perf binaries by non-administrative users.

What your security team should do

• Prioritize kernel updates on all non-hybrid Intel systems that allow perf access
• Restrict perf usage to trusted users via capabilities or cgroups until patched
• Monitor for kernel oops or KASAN reports related to perf and PEBS on production hosts