CVE-2025-38424: Linux Kernel perf Subsystem Vulnerability During Process Exit

A race condition vulnerability has been identified in the Linux kernel's perf subsystem. Specifically, the vulnerability can occur during process exit when perf tries to sample user stacks, potentially leading to system crashes.

Vulnerability Details

• CVE ID: CVE-2025-38424
• Description: The Linux kernel is vulnerable to a race condition in the perf subsystem during process exit. This occurs when perf attempts to sample user stacks while the address space is being torn down, potentially leading to memory access errors and system crashes.
• CVSS Score and Vector: Awaiting Analysis. Likely a medium to high severity depending on exploitability and crash frequency. A potential CVSS vector might include factors for system availability impact.
• Exploit Requirements: Requires a specific configuration of perf sampling during process exit scenarios.
• Affected Vendor, Product, Version: Linux kernel (versions prior to the fix).
• CWE: CWE-362 - Race Condition. A race condition occurs when the behavior of a system depends on the unpredictable sequence or timing of other events. In this case, the timing between perf stack sampling and the tearing down of the address space leads to the vulnerability.

Timeline of Events

• Reported: Unknown
• Discovered by: Baisheng Gao
• Patched: 2025-07-25 (approximate date of patch inclusion in stable kernel branches)

Exploitability & Real-World Risk

While the vulnerability requires a specific scenario involving perf sampling during process exit, successful exploitation could lead to denial-of-service conditions due to system crashes. The risk is moderate, as triggering the race condition might require careful setup, but its impact is potentially severe. In real-world scenarios, this vulnerability could be triggered in environments utilizing performance monitoring tools that rely on perf.

Recommendations

• Apply Patches: Update to the latest stable Linux kernel version that includes the fix for this vulnerability.
• Monitor Perf Usage: In environments where perf is actively used, monitor for unusual crash patterns that might indicate this vulnerability being triggered.
• Harden Configurations: Consider disabling or restricting user stack sampling during critical operations to minimize the risk.

Technical Insight

The core of the issue lies in the timing of events during process exit. The `do_exit()` function is responsible for cleaning up a process's resources, including its memory map. The perf subsystem attempts to sample user stacks, which involves accessing memory within the exiting process's address space. Before the fix, perf wasn't adequately stopped before the address space was torn down. This could result in perf attempting to access memory that no longer exists, leading to a crash. The fix involves ensuring that perf is stopped before the address space teardown commences and hardening stack sampling functions to avoid operating on processes without a valid memory map.

Credit to Researcher(s)

Discovered and reported by Baisheng Gao.

References

• Kernel Commit 1
• Kernel Commit 2
• Kernel Commit 3
• Kernel Commit 4
• Kernel Commit 5
• Kernel Commit 6
• Kernel Commit 7
• Kernel Commit 8

Tags

#LinuxKernel #perf #Security #CVE-2025-38424 #RaceCondition

Summary: A race condition vulnerability in the Linux kernel's perf subsystem can lead to crashes during process exit due to improper stack sampling during address space teardown. Updating to the latest kernel version containing the fix is recommended.

CVE ID: CVE-2025-38424

Risk Analysis: Successful exploitation of this vulnerability can lead to denial-of-service conditions due to system crashes. This can disrupt services and impact system availability.

Recommendation: Update to the latest stable Linux kernel version that includes the fix for this vulnerability. Additionally, monitor perf usage and consider hardening configurations to minimize the risk.

Timeline

• 2025-07-25: Fix committed to stable kernel branches

References

• https://git.kernel.org/stable/c/2ee6044a693735396bb47eeaba1ac3ae26c1c99b
• https://git.kernel.org/stable/c/456019adaa2f5366b89c868dea9b483179bece54
• https://git.kernel.org/stable/c/4f6fc782128355931527cefe3eb45338abd8ab39
• https://git.kernel.org/stable/c/507c9a595bad3abd107c6a8857d7fd125d89f386
• https://git.kernel.org/stable/c/7311970d07c4606362081250da95f2c7901fc0db
• https://git.kernel.org/stable/c/7b8f3c72175c6a63a95cf2e219f8b78e2baad34e
• https://git.kernel.org/stable/c/975ffddfa2e19823c719459d2364fcaa17673964
• https://git.kernel.org/stable/c/a9f6aab7910a0ef2895797f15c947f6d1053160f