CVE-2025-40327

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix system hang caused by cpu-clock usage cpu-clock usage by the async-profiler tool can trigger a system hang, which got bisected back to the following commit by Octavia Togami: 18dbcbfabfff ("perf: Fix the POLL_HUP delivery breakage") causes this issue The root cause of the hang is that cpu-clock is a special type of SW event which relies on hrtimers. The __perf_event_overflow() callback is invoked from the hrtimer handler for cpu-clock events, and __perf_event_overflow() tries to call cpu_clock_event_stop() to stop the event, which calls htimer_cancel() to cancel the hrtimer. But that's a recursion into the hrtimer code from a hrtimer handler, which (unsurprisingly) deadlocks. To fix this bug, use hrtimer_try_to_cancel() instead, and set the PERF_HES_STOPPED flag, which causes perf_swevent_hrtimer() to stop the event once it sees the PERF_HES_STOPPED flag. [ mingo: Fixed the comments and improved the changelog. ]

CVSS

No CVSS.

References

Link	Resource
https://git.kernel.org/stable/c/6b8c512811644cf2f5eaf6f44e928683c54127f0
https://git.kernel.org/stable/c/eb3182ef0405ff2f6668fd3e5ff9883f60ce8801

Configurations

No configuration.

History

No history.

Information

Published : 2025-12-09 16:17

Updated : 2026-06-17 09:21

NVD link : CVE-2025-40327

Mitre link : CVE-2025-40327

CVE.ORG link : CVE-2025-40327

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2025-40327", "cveTags": [], "metrics": {}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "18dbcbfabfffc4a5d3ea10290c5ad27f22b0d240", "lessThan": "6b8c512811644cf2f5eaf6f44e928683c54127f0", "versionType": "git"}, {"status": "affected", "version": "18dbcbfabfffc4a5d3ea10290c5ad27f22b0d240", "lessThan": "eb3182ef0405ff2f6668fd3e5ff9883f60ce8801", "versionType": "git"}, {"status": "affected", "version": "b2de0c9ce8e542b5cb4cd3944620d9dd1ea1f0ac", "versionType": "git"}, {"status": "affected", "version": "6.16.8", "lessThan": "6.17", "versionType": "semver"}], "programFiles": ["kernel/events/core.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.17"}, {"status": "unaffected", "version": "0", "lessThan": "6.17", "versionType": "semver"}, {"status": "unaffected", "version": "6.17.8", "versionType": "semver", "lessThanOrEqual": "6.17.*"}, {"status": "unaffected", "version": "6.18", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["kernel/events/core.c"], "defaultStatus": "affected"}]}], "published": "2025-12-09T16:17:42.787", "references": [{"url": "https://git.kernel.org/stable/c/6b8c512811644cf2f5eaf6f44e928683c54127f0", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/eb3182ef0405ff2f6668fd3e5ff9883f60ce8801", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Deferred", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf/core: Fix system hang caused by cpu-clock usage\n\ncpu-clock usage by the async-profiler tool can trigger a system hang,\nwhich got bisected back to the following commit by Octavia Togami:\n\n 18dbcbfabfff (\"perf: Fix the POLL_HUP delivery breakage\") causes this issue\n\nThe root cause of the hang is that cpu-clock is a special type of SW\nevent which relies on hrtimers. The __perf_event_overflow() callback\nis invoked from the hrtimer handler for cpu-clock events, and\n__perf_event_overflow() tries to call cpu_clock_event_stop()\nto stop the event, which calls htimer_cancel() to cancel the hrtimer.\n\nBut that's a recursion into the hrtimer code from a hrtimer handler,\nwhich (unsurprisingly) deadlocks.\n\nTo fix this bug, use hrtimer_try_to_cancel() instead, and set\nthe PERF_HES_STOPPED flag, which causes perf_swevent_hrtimer()\nto stop the event once it sees the PERF_HES_STOPPED flag.\n\n[ mingo: Fixed the comments and improved the changelog. ]"}], "lastModified": "2026-06-17T09:21:39.947", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}