CVE-2025-37878 perf/core: Fix WARN_ON(!ctx) in __free_event() for partial init
A local attacker can trigger a kernel warning and potential crash in the Linux kernel's perf subsystem due to a null pointer dereference during event cleanup.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-37878?
CVE-2025-37878 is a medium-severity vulnerability in Linux kernel, published on 9 May 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
perf/core: Fix WARN_ON(!ctx) in __free_event() for partial init
Move the get_ctx(child_ctx) call and the child_event->ctx assignment to occur immediately after the child event is allocated. Ensure that child_event->ctx is non-NULL before any subsequent error path within inherit_event calls free_event(), satisfying the assumptions of the cleanup code.
Details:
There's no clear Fixes tag, because this bug is a side-effect of multiple interacting commits over time (up to 15 years old), not a single regression.
The code initially incremented refcount then assigned context immediately after the child_event was created. Later, an early validity check for child_event was added before the refcount/assignment. Even later, a WARN_ON_ONCE() cleanup check was added, assuming event->ctx is valid if the pmu_ctx is valid. The problem is that the WARN_ON_ONCE() could trigger after the initial check passed but before child_event->ctx was assigned, violating its precondition. The solution is to assign child_event->ctx right after its initial validation. This ensures the context exists for any subsequent checks or cleanup routines, resolving the WARN_ON_ONCE().
To resolve it, defer the refcount update and child_event->ctx assignment directly after child_event->pmu_ctx is set but before checking if the parent event is orphaned. The cleanup routine depends on event->pmu_ctx being non-NULL before it verifies event->ctx is non-NULL. This also maintains the author's original intent of passing in child_ctx to find_get_pmu_context before its refcount/assignment.
[ mingo: Expanded the changelog from another email by Gabriel Shahrouzi. ]
Weakness: CWE-617
Which versions are affected by CVE-2025-37878?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-37878?
Apply the vendor's patch.
Is CVE-2025-37878 being exploited?
There is no known exploitation of CVE-2025-37878 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-70150, BELL-CVE-2025-37878, DEBIAN-CVE-2025-37878, GHSA-h3xh-892p-rrrq, ROOT-OS-DEBIAN-11-CVE-2025-37878, ROOT-OS-DEBIAN-12-CVE-2025-37878 and 3 more.