CVE-2025-38564 in Linux
Summary
by MITRE • 08/19/2025
In the Linux kernel, the following vulnerability has been resolved:
perf/core: Handle buffer mapping fail correctly in perf_mmap()
After successful allocation of a buffer or a successful attachment to an existing buffer perf_mmap() tries to map the buffer read only into the page table. If that fails, the already set up page table entries are zapped, but the other perf specific side effects of that failure are not handled. The calling code just cleans up the VMA and does not invoke perf_mmap_close().
This leaks reference counts, corrupts user->vm accounting and also results in an unbalanced invocation of event::event_mapped().
Cure this by moving the event::event_mapped() invocation before the map_range() call so that on map_range() failure perf_mmap_close() can be invoked without causing an unbalanced event::event_unmapped() call.
perf_mmap_close() undoes the reference counts and eventually frees buffers.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 12/15/2025
The vulnerability identified as CVE-2025-38564 resides within the Linux kernel's performance monitoring subsystem, specifically in the perf/core component. This issue represents a critical flaw in how the kernel handles memory mapping operations for performance monitoring buffers, creating potential pathways for resource exhaustion and system instability. The vulnerability manifests during the perf_mmap() function execution when attempting to map performance monitoring buffers into user space virtual memory areas. The flaw occurs after successful buffer allocation or attachment to existing buffers, where the system attempts to establish read-only mappings in the page table structure. This particular vulnerability falls under the category of improper handling of error conditions and resource management failures, which aligns with CWE-704 and CWE-459 categories related to incorrect error handling and resource management issues.
The technical implementation of this vulnerability stems from the sequence of operations within perf_mmap() where event mapping occurs before proper error handling mechanisms are established. When the map_range() operation fails during the memory mapping process, the kernel correctly removes the page table entries but fails to properly unwind the associated performance monitoring state. This creates a cascade of issues including reference count leaks where the kernel maintains references to memory buffers that should have been released, and user virtual memory accounting corruption that can lead to incorrect memory usage reporting. The most significant consequence occurs with the unbalanced event::event_mapped() function calls, where the system fails to properly invoke the corresponding event::event_unmapped() cleanup function that would normally occur during normal operation. This imbalance creates a state where the performance monitoring subsystem maintains inconsistent internal state information that can lead to unpredictable behavior.
The operational impact of this vulnerability extends beyond simple resource leaks to potentially enable denial of service conditions and system instability. Attackers could exploit this flaw by repeatedly triggering performance monitoring buffer allocation and mapping failures, leading to progressive memory consumption and eventual system resource exhaustion. The reference count leaks directly contribute to memory pressure while the virtual memory accounting corruption can cause the system to misreport available memory resources. From a security perspective, this vulnerability creates opportunities for privilege escalation attacks where malicious processes could manipulate the performance monitoring subsystem to gain unauthorized access to system resources. The flaw also impacts system reliability as the inconsistent state management can cause unexpected kernel behavior and potential crashes. This vulnerability directly relates to ATT&CK techniques involving privilege escalation and resource exhaustion, as it enables attackers to manipulate kernel memory management subsystems.
Mitigation strategies for CVE-2025-38564 require immediate kernel updates and patches that restructure the perf_mmap() function to properly handle error conditions. The fix implemented addresses the core issue by reordering function calls to invoke event::event_mapped() before the map_range() operation, ensuring that perf_mmap_close() can be properly invoked even when mapping fails. This change prevents the unbalanced event call sequence and ensures proper cleanup of all associated resources. System administrators should prioritize applying kernel patches that contain this fix, particularly in production environments where performance monitoring is actively used. Additional monitoring should be implemented to detect unusual patterns in performance monitoring subsystem behavior that might indicate exploitation attempts. The vulnerability highlights the importance of proper error handling in kernel subsystems and demonstrates how seemingly minor ordering issues can create significant security implications. Organizations should also implement regular kernel security audits to identify similar issues in other subsystems and maintain up-to-date security patches to prevent exploitation of similar vulnerabilities.