{"id":"CVE-2025-38055","state":"PUBLISHED","title":"perf/x86/intel: Fix segfault with PEBS-via-PT with sample_freq","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nperf/x86/intel: Fix segfault with PEBS-via-PT with sample_freq\n\nCurrently, using PEBS-via-PT with a sample frequency instead of a sample\nperiod, causes a segfault.  For example:\n\n    BUG: kernel NULL pointer dereference, address: 0000000000000195\n    <NMI>\n    ? __die_body.cold+0x19/0x27\n    ? page_fault_oops+0xca/0x290\n    ? exc_page_fault+0x7e/0x1b0\n    ? asm_exc_page_fault+0x26/0x30\n    ? intel_pmu_pebs_event_update_no_drain+0x40/0x60\n    ? intel_pmu_pebs_event_update_no_drain+0x32/0x60\n    intel_pmu_drain_pebs_icl+0x333/0x350\n    handle_pmi_common+0x272/0x3c0\n    intel_pmu_handle_irq+0x10a/0x2e0\n    perf_event_nmi_handler+0x2a/0x50\n\nThat happens because intel_pmu_pebs_event_update_no_drain() assumes all the\npebs_enabled bits represent counter indexes, which is not always the case.\nIn this particular case, bits 60 and 61 are set for PEBS-via-PT purposes.\n\nThe behaviour of PEBS-via-PT with sample frequency is questionable because\nalthough a PMI is generated (PEBS_PMI_AFTER_EACH_RECORD), the period is not\nadjusted anyway.\n\nPutting that aside, fix intel_pmu_pebs_event_update_no_drain() by passing\nthe mask of counter bits instead of 'size'.  Note, prior to the Fixes\ncommit, 'size' would be limited to the maximum counter index, so the issue\nwas not hit.","publishedAt":"2025-06-18T09:33:35.556Z","updatedAt":"2026-05-23T15:58:53.921Z","severity":null,"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"722e42e45c2f1c6d1adec7813651dba5139f52f4","status":"affected","lessThan":"ca51db23166767a8445deb8331c9b8d5205d9287","versionType":"git"},{"version":"722e42e45c2f1c6d1adec7813651dba5139f52f4","status":"affected","lessThan":"0b1874a5b1173fbcb2185ab828f4c33d067e551e","versionType":"git"},{"version":"722e42e45c2f1c6d1adec7813651dba5139f52f4","status":"affected","lessThan":"99bcd91fabada0dbb1d5f0de44532d8008db93c6","versionType":"git"},{"version":"a9d6d466bcf0621a872e1052bc40e4c6f0541b8d","status":"affected","versionType":"git"},{"version":"6.10.5","status":"affected","lessThan":"6.11","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["arch/x86/events/intel/ds.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.11","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.11","versionType":"semver"},{"version":"6.12.31","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.14.9","status":"unaffected","lessThanOrEqual":"6.14.*","versionType":"semver"},{"version":"6.15","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["arch/x86/events/intel/ds.c"]}],"references":["https://git.kernel.org/stable/c/ca51db23166767a8445deb8331c9b8d5205d9287","https://git.kernel.org/stable/c/0b1874a5b1173fbcb2185ab828f4c33d067e551e","https://git.kernel.org/stable/c/99bcd91fabada0dbb1d5f0de44532d8008db93c6"],"weaknesses":[],"ingestedAt":"2026-10-29T20:09:09.358Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/38xxx/CVE-2025-38055.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-38055","state":"PUBLISHED","datePublished":"2025-06-18T09:33:35.556Z","dateUpdated":"2026-05-23T15:58:53.921Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2025-04-16T04:51:23.979Z"},"containers":{"cna":{"title":"perf/x86/intel: Fix segfault with PEBS-via-PT with sample_freq","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nperf/x86/intel: Fix segfault with PEBS-via-PT with sample_freq\n\nCurrently, using PEBS-via-PT with a sample frequency instead of a sample\nperiod, causes a segfault.  For example:\n\n    BUG: kernel NULL pointer dereference, address: 0000000000000195\n    <NMI>\n    ? __die_body.cold+0x19/0x27\n    ? page_fault_oops+0xca/0x290\n    ? exc_page_fault+0x7e/0x1b0\n    ? asm_exc_page_fault+0x26/0x30\n    ? intel_pmu_pebs_event_update_no_drain+0x40/0x60\n    ? intel_pmu_pebs_event_update_no_drain+0x32/0x60\n    intel_pmu_drain_pebs_icl+0x333/0x350\n    handle_pmi_common+0x272/0x3c0\n    intel_pmu_handle_irq+0x10a/0x2e0\n    perf_event_nmi_handler+0x2a/0x50\n\nThat happens because intel_pmu_pebs_event_update_no_drain() assumes all the\npebs_enabled bits represent counter indexes, which is not always the case.\nIn this particular case, bits 60 and 61 are set for PEBS-via-PT purposes.\n\nThe behaviour of PEBS-via-PT with sample frequency is questionable because\nalthough a PMI is generated (PEBS_PMI_AFTER_EACH_RECORD), the period is not\nadjusted anyway.\n\nPutting that aside, fix intel_pmu_pebs_event_update_no_drain() by passing\nthe mask of counter bits instead of 'size'.  Note, prior to the Fixes\ncommit, 'size' would be limited to the maximum counter index, so the issue\nwas not hit."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"722e42e45c2f1c6d1adec7813651dba5139f52f4","status":"affected","lessThan":"ca51db23166767a8445deb8331c9b8d5205d9287","versionType":"git"},{"version":"722e42e45c2f1c6d1adec7813651dba5139f52f4","status":"affected","lessThan":"0b1874a5b1173fbcb2185ab828f4c33d067e551e","versionType":"git"},{"version":"722e42e45c2f1c6d1adec7813651dba5139f52f4","status":"affected","lessThan":"99bcd91fabada0dbb1d5f0de44532d8008db93c6","versionType":"git"},{"version":"a9d6d466bcf0621a872e1052bc40e4c6f0541b8d","status":"affected","versionType":"git"},{"version":"6.10.5","status":"affected","lessThan":"6.11","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["arch/x86/events/intel/ds.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.11","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.11","versionType":"semver"},{"version":"6.12.31","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.14.9","status":"unaffected","lessThanOrEqual":"6.14.*","versionType":"semver"},{"version":"6.15","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["arch/x86/events/intel/ds.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/ca51db23166767a8445deb8331c9b8d5205d9287"},{"url":"https://git.kernel.org/stable/c/0b1874a5b1173fbcb2185ab828f4c33d067e551e"},{"url":"https://git.kernel.org/stable/c/99bcd91fabada0dbb1d5f0de44532d8008db93c6"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-05-23T15:58:53.921Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.11","versionEndExcluding":"6.12.31"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.11","versionEndExcluding":"6.14.9"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.11","versionEndExcluding":"6.15"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.10.5"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}