ACK: [SRU][N][PATCH 0/1] CVE-2025-38565

[Andrei Gherzan]

On 26/09/11 06:49AM, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2025-38565
> 
> [ Impact ]
> 
> In the Linux kernel, the following vulnerability has been resolved:
> 
> perf/core: Exit early on perf_mmap() fail
> 
> When perf_mmap() fails to allocate a buffer, it still invokes the
> event_mapped() callback of the related event. On X86 this might increase the
> perf_rdpmc_allowed reference counter. But nothing undoes this as
> perf_mmap_close() is never called in this case, which causes another reference
> count leak.
> 
> Return early on failure to prevent that.
> 
> [ Fix ]
> 
> noble/linux: backported from 07091aade394
> 
> The upstream change was reworked around a map_range/get_mapped refactor that
> is not present in this tree. The backport keeps the essential early exit that
> returns before the event_mapped() callback runs, and continues to use the
> older event->pmu->event_mapped() callback directly.
> 
> [ Test Plan ]
> 
> Build and boot tested.
> 
> [ Where Problems Could Occur ]
> 
> The change touches the perf_mmap() path in the core perf subsystem, so a bad
> fix could affect X86 systems running profiling or performance-monitoring
> tools that map perf ring buffers, particularly workloads that rely on
> userspace rdpmc access. Users who do not use perf event mmap or rdpmc, and
> non-X86 architectures where perf_rdpmc_allowed is not maintained, are not
> affected by this code.
> 
> [ Other Info ]
> 
> Kybele flow-v11-25-ga27c0fa6. Reference: d74fd480/v1

Acked-by: Andrei Gherzan <andrei.gherzan at canonical.com>

-- 
Andrei Gherzan
gpg: rsa4096/D4D94F67AD0E9640
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260916/823cc922/attachment.sig>