Junglewise Threat Intelligence

CVE-2025-40081: Linux Kernel integer overflow in ARM SPE PMU driver

CVE-2025-40081 · Severity: high · CVSS 7.8 · Published 2025-10-28

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability exists in the Linux kernel's performance monitoring tools for ARM processors. When handling very large data buffers (2GB or larger), the system may experience a mathematical overflow error. This could allow a local user to potentially crash the system or gain unauthorized access to sensitive information.

Technical details

An integer overflow exists in the PERF_IDX2OFF() macro within drivers/perf/arm_spe_pmu.c of the Linux kernel. The vulnerability is caused by failing to cast the 'nr_pages' variable to an unsigned long before performing a bitwise shift (PAGE_SHIFT), leading to an overflow when handling AUX buffer sizes of 2 GiB or greater. A local attacker with access to perf events could exploit this to cause memory corruption or information leakage. The issue has been resolved by explicitly casting nr_pages to unsigned long in the affected macro across multiple stable kernel branches.

Affected products

  • Linux Linux Kernel 4.15 to 6.11.5, 6.12-rc3

Timeline

  • 2025-09-17: disclosed: Initial patch authored by Leo Yan
  • 2025-10-15: patched: Patch committed to stable trees by Greg Kroah-Hartman
  • 2025-10-28: advisory: CVE published by kernel.org and NVD

References

Related threats