CVE-2025-38424: perf: Fix sample vs do_exit()
Vulnerability summary
CVE-2025-38424 is a high (CVSS 7.8) vulnerability in debian debian_linux. EPSS estimates a 0.22% chance of exploitation in the next 30 days, higher than 12.2% of scored vulnerabilities.
Not severe (CVSS 7.8, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 53 · Related 48Timeline
- 25-07-2025PublishedVulnerability first disclosed.
- 15-10-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: perf: Fix sample vs do_exit() Baisheng Gao reported an ARM64 crash, which Mark decoded as being a synchronous external abort -- most likely due to trying to access MMIO in bad ways. The crash further shows perf trying to do a user stack sample while in exit_mmap()'s tlb_finish_mmu() -- i.e. while tearing down the address space it is trying to access. It turns out that we stop perf after we tear down the userspace mm; a receipie for disaster, since perf likes to access userspace for various reasons. Flip this order by moving up where we stop perf in do_exit(). Additionally, harden PERF_SAMPLE_CALLCHAIN and PERF_SAMPLE_STACK_USER to abort when the current task does not have an mm (exit_mm() makes sure to set current->mm = NULL; before commencing with the actual teardown). Such that CPU wide events don't trip on this same problem.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HDiffers
- NVDNIST5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HDiffers
EPSS trend
Probability
0.22%
Chance of exploitation in the next 30 days
Percentile
12%
Versus all other CVEs
30-day change
Increase +0.03 pp
From 0.19% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu146 products
- linuxAll versions (No fix recorded) | < 5.15.0-156.166 | < 6.8.0-100.100
- linux-allwinner-5.19All versions (No fix recorded)
- linux-awsAll versions (No fix recorded) | < 5.15.0-1092.99 | < 6.8.0-1046.49
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Debian2 products
- linux< 6.1.147-1 | < 6.12.35-1
- debian_linuxEOL11.0
Linux2 products
- linux≥ c5ebcedb566ef17bda7b02686e0d658a7bb42ee7, < 7b8f3c72175c6a63a95cf2e219f8b78e2baad34e | ≥ c5ebcedb566ef17bda7b02686e0d658a7bb42ee7, < 507c9a595bad3abd107c6a8857d7fd125d89f386 | ≥ c5ebcedb566ef17bda7b02686e0d658a7bb42ee7, < a9f6aab7910a0ef2895797f15c947f6d1053160f | ≥ c5ebcedb566ef17bda7b02686e0d658a7bb42ee7, < 975ffddfa2e19823c719459d2364fcaa17673964 | ≥ c5ebcedb566ef17bda7b02686e0d658a7bb42ee7, < 2ee6044a693735396bb47eeaba1ac3ae26c1c99b | ≥ c5ebcedb566ef17bda7b02686e0d658a7bb42ee7, < 456019adaa2f5366b89c868dea9b483179bece54 | ≥ c5ebcedb566ef17bda7b02686e0d658a7bb42ee7, < 7311970d07c4606362081250da95f2c7901fc0db | ≥ c5ebcedb566ef17bda7b02686e0d658a7bb42ee7, < 4f6fc782128355931527cefe3eb45338abd8ab39 | 3.7
- linux_kernel≥ 3.7, < 5.4.295 | ≥ 5.5, < 5.10.239 | ≥ 5.11, < 5.15.186 | ≥ 5.16, < 6.1.142 | ≥ 6.2, < 6.6.95 | ≥ 6.7, < 6.12.35 | ≥ 6.13, < 6.15.4 | 6.16:rc1 | 6.16:rc2
3 vendors · 150 products
