CVE-2025-38564

perf/core: Handle buffer mapping fail correctly in perf_mmap()

published August 19, 2025

CVSS
—
EPSS
0%
Percentile
5.3
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

perf/core: Handle buffer mapping fail correctly in perf_mmap()

After successful allocation of a buffer or a successful attachment to an

existing buffer perf_mmap() tries to map the buffer read only into the page

table. If that fails, the already set up page table entries are zapped, but

the other perf specific side effects of that failure are not handled. The

calling code just cleans up the VMA and does not invoke perf_mmap_close().

This leaks reference counts, corrupts user->vm accounting and also results

in an unbalanced invocation of event::event_mapped().

Cure this by moving the event::event_mapped() invocation before the

map_range() call so that on map_range() failure perf_mmap_close() can be

invoked without causing an unbalanced event::event_unmapped() call.

perf_mmap_close() undoes the reference counts and eventually frees buffers.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00164 · 5.3th percentile
Published
2025-08-19T17:02Z
EPSS history
Timeline
  • 19 AUG 17:02Z
    perf/core: Handle buffer mapping fail correctly in perf_mmap()
    cvelistv5