Executive brief
A vulnerability in the Linux kernel's performance monitoring subsystem could allow a local user to disrupt system operations. By placing monitoring probes in the middle of computer instructions, an attacker could cause the system to behave unpredictably or crash. This issue has been addressed by restricting the use of these probes to system administrators only.
Technical details
A vulnerability in the Linux kernel's perf subsystem allowed users with CAP_PERFMON privileges to utilize uprobes destructively. The kernel's verification process only checked for a valid instruction at a requested offset but failed to account for variable instruction lengths or data mixed within text segments (common on architectures like arm64). This allowed probes to be placed in the middle of an instruction stream, potentially corrupting execution. The fix reverts the permission requirement for uprobes back to CAP_SYS_ADMIN to prevent unauthorized local users from triggering this behavior.
Affected products
- Linux Linux Kernel 5.8 to 5.10.240, 5.11 to 5.15.189, 5.16 to 6.1.146, 6.2 to 6.6.99, 6.7 to 6.12.39, 6.13 to 6.15.7
Timeline
- 2025-07-02: other: Patch authored by Peter Zijlstra
- 2025-07-25: disclosed: CVE published
References
- https://git.kernel.org/stable/c/183bdb89af1b5193b1d1d9316986053b15ca6fa4
- https://git.kernel.org/stable/c/8e8bf7bc6aa6f583336c2fda280b6cea0aed5612
- https://git.kernel.org/stable/c/a0a8009083e569b5526c64f7d3f2a62baca95164
- https://git.kernel.org/stable/c/ba677dbe77af5ffe6204e0f3f547f3ba059c6302
- https://git.kernel.org/stable/c/c0aec35f861fa746ca45aa816161c74352e6ada8
- https://git.kernel.org/stable/c/d5074256b642cdeb46a70ce2f15193e766edca68
- https://git.kernel.org/stable/c/d7ef1afd5b3f43f4924326164cee5397b66abd9c