CVE-2025-38055

In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: Fix segfault with PEBS-via-PT with sample_freq Currently, using PEBS-via-PT with a sample frequency instead of a sample period, causes a segfault. For example: BUG: kernel NULL pointer dereference, address: 0000000000000195 <NMI> ? __die_body.cold+0x19/0x27 ? page_fault_oops+0xca/0x290 ? exc_page_fault+0x7e/0x1b0 ? asm_exc_page_fault+0x26/0x30 ? intel_pmu_pebs_event_update_no_drain+0x40/0x60 ? intel_pmu_pebs_event_update_no_drain+0x32/0x60 intel_pmu_drain_pebs_icl+0x333/0x350 handle_pmi_common+0x272/0x3c0 intel_pmu_handle_irq+0x10a/0x2e0 perf_event_nmi_handler+0x2a/0x50 That happens because intel_pmu_pebs_event_update_no_drain() assumes all the pebs_enabled bits represent counter indexes, which is not always the case. In this particular case, bits 60 and 61 are set for PEBS-via-PT purposes. The behaviour of PEBS-via-PT with sample frequency is questionable because although a PMI is generated (PEBS_PMI_AFTER_EACH_RECORD), the period is not adjusted anyway. Putting that aside, fix intel_pmu_pebs_event_update_no_drain() by passing the mask of counter bits instead of 'size'. Note, prior to the Fixes commit, 'size' would be limited to the maximum counter index, so the issue was not hit.

• CWE-476

• https://git.kernel.org/stable/c/0b1874a5b1173fbcb2185ab828f4c33d067e551ePatch
• https://git.kernel.org/stable/c/99bcd91fabada0dbb1d5f0de44532d8008db93c6Patch
• https://git.kernel.org/stable/c/ca51db23166767a8445deb8331c9b8d5205d9287Patch

Published

Jun 18, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-3805A vulnerability classified as critical was found in sarriona…5.3
• CVE-2025-38050In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-38051In the Linux kernel, the following vulnerability has been re…7
• CVE-2025-38052In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2025-38053In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-38054In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-38056In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2025-38057In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-38058In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-38059In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-3806A vulnerability, which was classified as problematic, has be…4.8
• CVE-2025-38060In the Linux kernel, the following vulnerability has been re…5.5