Summaryinfo

A vulnerability labeled as critical has been found in Linux Kernel up to 6.17.7. The affected element is the function __perf_event_overflow. The manipulation results in recursion. This vulnerability is known as CVE-2025-40327. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as critical has been found in Linux Kernel up to 6.17.7. Affected is the function __perf_event_overflow. The manipulation with an unknown input leads to a recursion vulnerability. CWE is classifying the issue as CWE-674. The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack. This is going to have an impact on availability. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix system hang caused by cpu-clock usage cpu-clock usage by the async-profiler tool can trigger a system hang, which got bisected back to the following commit by Octavia Togami: 18dbcbfabfff ("perf: Fix the POLL_HUP delivery breakage") causes this issue The root cause of the hang is that cpu-clock is a special type of SW event which relies on hrtimers. The __perf_event_overflow() callback is invoked from the hrtimer handler for cpu-clock events, and __perf_event_overflow() tries to call cpu_clock_event_stop() to stop the event, which calls htimer_cancel() to cancel the hrtimer. But that's a recursion into the hrtimer code from a hrtimer handler, which (unsurprisingly) deadlocks. To fix this bug, use hrtimer_try_to_cancel() instead, and set the PERF_HES_STOPPED flag, which causes perf_swevent_hrtimer() to stop the event once it sees the PERF_HES_STOPPED flag. [ mingo: Fixed the comments and improved the changelog. ]

The advisory is available at git.kernel.org. This vulnerability is traded as CVE-2025-40327 since 04/16/2025. The exploitability is told to be difficult. Technical details are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 298897 (Ubuntu 25.10 : Linux kernel vulnerabilities (USN-8029-1)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 6.17.8 eliminates this vulnerability. Applying the patch 6b8c512811644cf2f5eaf6f44e928683c54127f0/eb3182ef0405ff2f6668fd3e5ff9883f60ce8801 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (298897) and CERT Bund (WID-SEC-2025-2765). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Affected

• Debian Linux
• Amazon Linux 2
• Red Hat Enterprise Linux
• Ubuntu Linux
• SUSE Linux
• Oracle Linux
• SUSE openSUSE
• Open Source Linux Kernel
• RESF Rocky Linux

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 6.17.0
• 6.17.1
• 6.17.2
• 6.17.3
• 6.17.4
• 6.17.5
• 6.17.6
• 6.17.7

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion