CVE-2025-38564

{"id": "CVE-2025-38564", "cveTags": [], "metrics": {}, "published": "2025-08-19T17:15:32.933", "references": [{"url": "https://git.kernel.org/stable/c/831e1c90a5d72e6977a57c44f47c46b73a438695", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/a9025f73c88d9d6e125743a43afc569da3ce5328", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/f74b9f4ba63ffdf597aaaa6cad7e284cb8e04820", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Awaiting Analysis", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf/core: Handle buffer mapping fail correctly in perf_mmap()\n\nAfter successful allocation of a buffer or a successful attachment to an\nexisting buffer perf_mmap() tries to map the buffer read only into the page\ntable. If that fails, the already set up page table entries are zapped, but\nthe other perf specific side effects of that failure are not handled. The\ncalling code just cleans up the VMA and does not invoke perf_mmap_close().\n\nThis leaks reference counts, corrupts user->vm accounting and also results\nin an unbalanced invocation of event::event_mapped().\n\nCure this by moving the event::event_mapped() invocation before the\nmap_range() call so that on map_range() failure perf_mmap_close() can be\ninvoked without causing an unbalanced event::event_unmapped() call.\n\nperf_mmap_close() undoes the reference counts and eventually frees buffers."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: perf/core: Manejar el error de mapeo de b\u00fafer correctamente en perf_mmap() Despu\u00e9s de la asignaci\u00f3n exitosa de un b\u00fafer o una conexi\u00f3n exitosa a un b\u00fafer existente, perf_mmap() intenta mapear el b\u00fafer de solo lectura en la tabla de p\u00e1ginas. Si eso falla, las entradas de la tabla de p\u00e1ginas ya configuradas se eliminan, pero los otros efectos secundarios espec\u00edficos de perf de ese fallo no se manejan. El c\u00f3digo de llamada simplemente limpia el VMA y no invoca perf_mmap_close(). Esto filtra los recuentos de referencia, corrompe la contabilidad de usuario->vm y tambi\u00e9n resulta en una invocaci\u00f3n desequilibrada de event::event_mapped(). Solucione esto moviendo la invocaci\u00f3n de event::event_mapped() antes de la llamada a map_range() para que en el fallo de map_range() se pueda invocar perf_mmap_close() sin causar una llamada desequilibrada a event::event_unmapped(). perf_mmap_close() deshace los recuentos de referencia y eventualmente libera los b\u00faferes."}], "lastModified": "2025-08-20T14:40:17.713", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}