# CVE-2025-40327: perf/core: Fix system hang caused by cpu-clock usage

> A local attacker can cause a system hang in the Linux kernel by triggering a deadlock in the perf subsystem via cpu-clock events.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Any signed-in user
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 9 Dec 2025
- **Updated:** 23 May 2026
- **Also known as:** BELL-CVE-2025-40327, DEBIAN-CVE-2025-40327, GHSA-px83-f67g-j9g9, UBUNTU-CVE-2025-40327

## What is CVE-2025-40327?

CVE-2025-40327 is a denial of service vulnerability in Linux, published on 9 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

perf/core: Fix system hang caused by cpu-clock usage

cpu-clock usage by the async-profiler tool can trigger a system hang,
which got bisected back to the following commit by Octavia Togami:

  18dbcbfabfff ("perf: Fix the POLL_HUP delivery breakage") causes this issue

The root cause of the hang is that cpu-clock is a special type of SW
event which relies on hrtimers. The __perf_event_overflow() callback
is invoked from the hrtimer handler for cpu-clock events, and
__perf_event_overflow() tries to call cpu_clock_event_stop()
to stop the event, which calls htimer_cancel() to cancel the hrtimer.

But that's a recursion into the hrtimer code from a hrtimer handler,
which (unsurprisingly) deadlocks.

To fix this bug, use hrtimer_try_to_cancel() instead, and set
the PERF_HES_STOPPED flag, which causes perf_swevent_hrtimer()
to stop the event once it sees the PERF_HES_STOPPED flag.

[ mingo: Fixed the comments and improved the changelog. ]

## Which versions are affected by CVE-2025-40327?


## How do I fix CVE-2025-40327?

Apply the vendor's patch.

## Is CVE-2025-40327 being exploited?

There is no known exploitation of CVE-2025-40327 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2025-40327 and fix it if it is affected.

What it is: CVE-2025-40327 is a denial of service vulnerability in Linux, published on 9 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2025-40327 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2025-40327/ (Markdown: https://insights.sbomify.com/CVE-2025-40327/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2025-40327
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-40327
- OSV: https://osv.dev/vulnerability/CVE-2025-40327

---
From sbomify Insights: https://insights.sbomify.com/CVE-2025-40327/
Summaries are generated and may contain mistakes; the official description above is the record.