{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2025-40122 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2025-40122 is a denial of service vulnerability in Linux, published on 12 Nov 2025. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2025-40122 and fix it if it is affected.\n\nWhat it is: CVE-2025-40122 is a denial of service vulnerability in Linux, published on 12 Nov 2025. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2025-40122 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2025-40122/ (Markdown: https://insights.sbomify.com/CVE-2025-40122/index.md)","id":"CVE-2025-40122","markdown":"https://insights.sbomify.com/CVE-2025-40122/index.md","name":"CVE-2025-40122","record":{"aliases":["BELL-CVE-2025-40122","DEBIAN-CVE-2025-40122","GHSA-pp9f-hhc8-x68x","UBUNTU-CVE-2025-40122"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel","requires_auth":"low_privilege","summary":"A local attacker can trigger a kernel crash by exploiting incorrect MSR access checks in the Intel PMU driver.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nperf/x86/intel: Fix IA32_PMC_x_CFG_B MSRs access error\n\nWhen running perf_fuzzer on PTL, sometimes the below \"unchecked MSR\n access error\" is seen when accessing IA32_PMC_x_CFG_B MSRs.\n\n[   55.611268] unchecked MSR access error: WRMSR to 0x1986 (tried to write 0x0000000200000001) at rIP: 0xffffffffac564b28 (native_write_msr+0x8/0x30)\n[   55.611280] Call Trace:\n[   55.611282]  \u003cTASK\u003e\n[   55.611284]  ? intel_pmu_config_acr+0x87/0x160\n[   55.611289]  intel_pmu_enable_acr+0x6d/0x80\n[   55.611291]  intel_pmu_enable_event+0xce/0x460\n[   55.611293]  x86_pmu_start+0x78/0xb0\n[   55.611297]  x86_pmu_enable+0x218/0x3a0\n[   55.611300]  ? x86_pmu_enable+0x121/0x3a0\n[   55.611302]  perf_pmu_enable+0x40/0x50\n[   55.611307]  ctx_resched+0x19d/0x220\n[   55.611309]  __perf_install_in_context+0x284/0x2f0\n[   55.611311]  ? __pfx_remote_function+0x10/0x10\n[   55.611314]  remote_function+0x52/0x70\n[   55.611317]  ? __pfx_remote_function+0x10/0x10\n[   55.611319]  generic_exec_single+0x84/0x150\n[   55.611323]  smp_call_function_single+0xc5/0x1a0\n[   55.611326]  ? __pfx_remote_function+0x10/0x10\n[   55.611329]  perf_install_in_context+0xd1/0x1e0\n[   55.611331]  ? __pfx___perf_install_in_context+0x10/0x10\n[   55.611333]  __do_sys_perf_event_open+0xa76/0x1040\n[   55.611336]  __x64_sys_perf_event_open+0x26/0x30\n[   55.611337]  x64_sys_call+0x1d8e/0x20c0\n[   55.611339]  do_syscall_64+0x4f/0x120\n[   55.611343]  entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nOn PTL, GP counter 0 and 1 doesn't support auto counter reload feature,\nthus it would trigger a #GP when trying to write 1 on bit 0 of CFG_B MSR\nwhich requires to enable auto counter reload on GP counter 0.\n\nThe root cause of causing this issue is the check for auto counter\nreload (ACR) counter mask from user space is incorrect in\nintel_pmu_acr_late_setup() helper. It leads to an invalid ACR counter\nmask from user space could be set into hw.config1 and then written into\nCFG_B MSRs and trigger the MSR access warning.\n\ne.g., User may create a perf event with ACR counter mask (config2=0xcb),\nand there is only 1 event created, so \"cpuc-\u003en_events\" is 1.\n\nThe correct check condition should be \"i + idx \u003e= cpuc-\u003en_events\"\ninstead of \"i + idx \u003e cpuc-\u003en_events\" (it looks a typo). Otherwise,\nthe counter mask would traverse twice and an invalid \"cpuc-\u003eassign[1]\"\nbit (bit 0) is set into hw.config1 and cause MSR accessing error.\n\nBesides, also check if the ACR counter mask corresponding events are\nACR events. If not, filter out these counter mask. If a event is not a\nACR event, it could be scheduled to an HW counter which doesn't support\nACR. It's invalid to add their counter index in ACR counter mask.\n\nFurthermore, remove the WARN_ON_ONCE() since it's easily triggered as\nuser could set any invalid ACR counter mask and the warning message\ncould mislead users.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"perf/x86/intel: Fix IA32_PMC_x_CFG_B MSRs access error","id":"CVE-2025-40122","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"denial_of_service","year":"2025"},"n_packages":0,"n_references":2,"next":{"headline":"bpf: Enforce expected_attach_type for tailcall compatibility","id":"CVE-2025-40123"},"packages":[],"prev":{"headline":"ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping","id":"CVE-2025-40121"},"products":["Linux"],"published":"2025-11-12","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-05-11","vendors":["Linux"]},"summary":"A local attacker can trigger a kernel crash by exploiting incorrect MSR access checks in the Intel PMU driver.","url":"https://insights.sbomify.com/CVE-2025-40122/"}