| { |
| "containers": { |
| "cna": { |
| "providerMetadata": { |
| "orgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038" |
| }, |
| "descriptions": [ |
| { |
| "lang": "en", |
| "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/cpumf: Fix double free on error in cpumf_pmu_event_init()\n\nIn PMU event initialization functions\n - cpumsf_pmu_event_init()\n - cpumf_pmu_event_init()\n - cfdiag_event_init()\nthe partially created event had to be removed when an error was detected.\nThe event::event_init() member function had to release all resources\nit allocated in case of error. event::destroy() had to be called\non freeing an event after it was successfully created and\nevent::event_init() returned success.\n\nWith\n\ncommit c70ca298036c (\"perf/core: Simplify the perf_event_alloc() error path\")\n\nthis is not necessary anymore. The performance subsystem common\ncode now always calls event::destroy() to clean up the allocated\nresources created during event initialization.\n\nRemove the event::destroy() invocation in PMU event initialization\nor that function is called twice for each event that runs into an\nerror condition in event creation.\n\nThis is the kernel log entry which shows up without the fix:\n\n------------[ cut here ]------------\nrefcount_t: underflow; use-after-free.\nWARNING: CPU: 0 PID: 43388 at lib/refcount.c:87\trefcount_dec_not_one+0x74/0x90\nCPU: 0 UID: 0 PID: 43388 Comm: perf Not tainted 6.15.0-20250407.rc1.git0.300.fc41.s390x+git #1 NONE\nHardware name: IBM 3931 A01 704 (LPAR)\nKrnl PSW : 0704c00180000000 00000209cb2c1b88 (refcount_dec_not_one+0x78/0x90)\n R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:0 PM:0 RI:0 EA:3\nKrnl GPRS: 0000020900000027 0000020900000023 0000000000000026 0000018900000000\n 00000004a2200a00 0000000000000000 0000000000000057 ffffffffffffffea\n 00000002b386c600 00000002b3f5b3e0 00000209cc51f140 00000209cc7fc550\n 0000000001449d38 ffffffffffffffff 00000209cb2c1b84 00000189d67dfb80\nKrnl Code: 00000209cb2c1b78: c02000506727\tlarl\t%r2,00000209cbcce9c6\n 00000209cb2c1b7e: c0e5ffbd4431\tbrasl\t%r14,00000209caa6a3e0\n #00000209cb2c1b84: af000000\t\tmc\t0,0\n >00000209cb2c1b88: a7480001\t\tlhi\t%r4,1\n 00000209cb2c1b8c: ebeff0a00004\tlmg\t%r14,%r15,160(%r15)\n 00000209cb2c1b92: ec243fbf0055\trisbg\t%r2,%r4,63,191,0\n 00000209cb2c1b98: 07fe\t\tbcr\t15,%r14\n 00000209cb2c1b9a: 47000700\t\tbc\t0,1792\nCall Trace:\n [<00000209cb2c1b88>] refcount_dec_not_one+0x78/0x90\n [<00000209cb2c1dc4>] refcount_dec_and_mutex_lock+0x24/0x90\n [<00000209caa3c29e>] hw_perf_event_destroy+0x2e/0x80\n [<00000209cacaf8b4>] __free_event+0x74/0x270\n [<00000209cacb47c4>] perf_event_alloc.part.0+0x4a4/0x730\n [<00000209cacbf3e8>] __do_sys_perf_event_open+0x248/0xc20\n [<00000209cacc14a4>] __s390x_sys_perf_event_open+0x44/0x50\n [<00000209cb8114de>] __do_syscall+0x12e/0x260\n [<00000209cb81ce34>] system_call+0x74/0x98\nLast Breaking-Event-Address:\n [<00000209caa6a4d2>] __warn_printk+0xf2/0x100\n---[ end trace 0000000000000000 ]---" |
| } |
| ], |
| "affected": [ |
| { |
| "product": "Linux", |
| "vendor": "Linux", |
| "defaultStatus": "unaffected", |
| "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", |
| "programFiles": [ |
| "arch/s390/kernel/perf_cpum_cf.c", |
| "arch/s390/kernel/perf_cpum_sf.c" |
| ], |
| "versions": [ |
| { |
| "version": "7ef5aa081f989ecfecc1df02068a80aebbd3ec31", |
| "lessThan": "bdbecb2bf531fadbbc9347a79009f7a58ea7eb03", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "315a50c6b1c6ce191f19f3372935d8e2ed9b53a6", |
| "lessThan": "3a3faf873db5dcd5d2622d8e2accb90af0a86c2d", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "1209b0b29fd472e7dbd2b06544b019dd9f9b7e51", |
| "lessThan": "ddf60c1491102dab04491481bc3376d3e9cd139d", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "c70ca298036c58a88686ff388d3d367e9d21acf0", |
| "lessThan": "aa1ac98268cd1f380c713f07e39b1fa1d5c7650c", |
| "status": "affected", |
| "versionType": "git" |
| } |
| ] |
| }, |
| { |
| "product": "Linux", |
| "vendor": "Linux", |
| "defaultStatus": "affected", |
| "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", |
| "programFiles": [ |
| "arch/s390/kernel/perf_cpum_cf.c", |
| "arch/s390/kernel/perf_cpum_sf.c" |
| ], |
| "versions": [ |
| { |
| "version": "6.15-rc1", |
| "status": "affected" |
| }, |
| { |
| "version": "0", |
| "lessThan": "6.15-rc1", |
| "status": "unaffected", |
| "versionType": "semver" |
| }, |
| { |
| "version": "6.15-rc2", |
| "lessThanOrEqual": "*", |
| "status": "unaffected", |
| "versionType": "original_commit_for_fix" |
| } |
| ] |
| } |
| ], |
| "cpeApplicability": [ |
| { |
| "nodes": [ |
| { |
| "operator": "OR", |
| "negate": false, |
| "cpeMatch": [ |
| { |
| "vulnerable": true, |
| "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", |
| "versionStartIncluding": "6.15-rc1", |
| "versionEndExcluding": "6.15-rc2" |
| } |
| ] |
| } |
| ] |
| } |
| ], |
| "references": [ |
| { |
| "url": "https://git.kernel.org/stable/c/bdbecb2bf531fadbbc9347a79009f7a58ea7eb03" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/3a3faf873db5dcd5d2622d8e2accb90af0a86c2d" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/ddf60c1491102dab04491481bc3376d3e9cd139d" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/aa1ac98268cd1f380c713f07e39b1fa1d5c7650c" |
| } |
| ], |
| "title": "s390/cpumf: Fix double free on error in cpumf_pmu_event_init()", |
| "x_generator": { |
| "engine": "bippy-1.2.0" |
| } |
| } |
| }, |
| "cveMetadata": { |
| "assignerOrgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038", |
| "cveID": "CVE-2025-37753", |
| "requesterUserId": "gregkh@kernel.org", |
| "serial": "1", |
| "state": "PUBLISHED" |
| }, |
| "dataType": "CVE_RECORD", |
| "dataVersion": "5.0" |
| } |
