CVE-2025-38564 perf/core: Handle buffer mapping fail correctly in perf_mmap()
A flaw in the Linux kernel's perf subsystem causes reference count leaks and accounting corruption upon mapping failure, potentially leading to denial of service or privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-38564?
CVE-2025-38564 is a medium-severity memory corruption vulnerability in Linux kernel, published on 19 Aug 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
perf/core: Handle buffer mapping fail correctly in perf_mmap()
After successful allocation of a buffer or a successful attachment to an existing buffer perf_mmap() tries to map the buffer read only into the page table. If that fails, the already set up page table entries are zapped, but the other perf specific side effects of that failure are not handled. The calling code just cleans up the VMA and does not invoke perf_mmap_close().
This leaks reference counts, corrupts user->vm accounting and also results in an unbalanced invocation of event::event_mapped().
Cure this by moving the event::event_mapped() invocation before the map_range() call so that on map_range() failure perf_mmap_close() can be invoked without causing an unbalanced event::event_unmapped() call.
perf_mmap_close() undoes the reference counts and eventually frees buffers.
Which versions are affected by CVE-2025-38564?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-38564?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-38564 being exploited?
There is no known exploitation of CVE-2025-38564 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2025-38564, GHSA-m482-hf2v-9c7j, UBUNTU-CVE-2025-38564.