Executive brief
A vulnerability exists in the Linux kernel's performance monitoring tools for ARM processors. When handling very large data buffers (2GB or larger), the system may experience a mathematical overflow error. This could allow a local user to potentially crash the system or gain unauthorized access to sensitive information.
Technical details
An integer overflow exists in the PERF_IDX2OFF() macro within drivers/perf/arm_spe_pmu.c of the Linux kernel. The vulnerability is caused by failing to cast the 'nr_pages' variable to an unsigned long before performing a bitwise shift (PAGE_SHIFT), leading to an overflow when handling AUX buffer sizes of 2 GiB or greater. A local attacker with access to perf events could exploit this to cause memory corruption or information leakage. The issue has been resolved by explicitly casting nr_pages to unsigned long in the affected macro across multiple stable kernel branches.
Affected products
- Linux Linux Kernel 4.15 to 6.11.5, 6.12-rc3
Timeline
- 2025-09-17: disclosed: Initial patch authored by Leo Yan
- 2025-10-15: patched: Patch committed to stable trees by Greg Kroah-Hartman
- 2025-10-28: advisory: CVE published by kernel.org and NVD
References
- https://git.kernel.org/stable/c/1a19ba8e1f4ff24ece8ca69b79df8442c431db90
- https://git.kernel.org/stable/c/379cae2cb982f571cda9493ac573ab71125fd299
- https://git.kernel.org/stable/c/5d01f2b81568289443d22f1e13a363f829de6343
- https://git.kernel.org/stable/c/656e9a5d69acdd1b20462f4a33378b90ddcb9626
- https://git.kernel.org/stable/c/7500384d3c9587593d75ded3b006835e7aa73ef8
- https://git.kernel.org/stable/c/9c045d4501f7f70724a3bbb561f4f22d292bbfe6
- https://git.kernel.org/stable/c/a29fea30dd93da16652930162b177941abd8c75e