Security readout for executives and security teams
Plain-English summary
A Linux perf timing flaw can sample a process’s user stack while its address space is being destroyed. The reported outcome was an ARM64 kernel crash. Because triggering requires local, low-privileged access, this is primarily a host stability and local security concern, not a remotely exploitable issue based on available evidence.
Executive priority
Treat as a high-priority kernel maintenance issue for shared or perf-enabled Linux systems. Patch through normal expedited change control, prioritizing exposed multi-user hosts. Emergency incident response is not supported solely by current evidence because active exploitation is unconfirmed and access is local.
Technical view
During do_exit(), perf was stopped after exit_mmap() began dismantling the userspace memory map. PERF_SAMPLE_CALLCHAIN or PERF_SAMPLE_STACK_USER could therefore access an invalid address space. The fix stops perf earlier and rejects these samples when current->mm is NULL, also protecting CPU-wide events.
Likely exposure
Exposure applies to affected Linux kernel builds using perf sampling, particularly user-stack or call-chain sampling during process exit. The supplied version data is ambiguous and should not be treated as a definitive package list; confirm status against each distribution’s kernel advisory and changelog.
Exploitation context
The CVSS vector describes a local, low-complexity issue requiring low privileges and no user interaction. CISA KEV status is false, and the supplied sources do not establish active exploitation or a public weaponized exploit. The documented evidence is an ARM64 crash; broader confidentiality or integrity impact is not demonstrated in the description.
Researcher notes
The source establishes an ordering defect and defensive checks, but does not document a reliable security exploit, affected configuration prerequisites, or demonstrated privilege escalation. Version records appear flattened or incomplete; use stable commit ancestry and distribution package status for authoritative exposure decisions.
Mitigation direction
- Install a vendor-supported kernel containing the applicable stable fix.
- Check distribution advisories for exact corrected package versions.
- Prioritize multi-user, shared-compute, and perf-enabled systems.
- If updates are delayed, obtain vendor-approved compensating guidance; none is specified in the supplied sources.
Validation and detection
- Inventory kernel versions across Linux hosts and container nodes.
- Compare installed packages with distribution advisories and changelogs.
- Confirm the kernel includes the applicable referenced stable commit.
- Review kernel logs for perf, exit_mmap, tlb_finish_mmu, or synchronous external abort crashes.
- After updating, verify the new kernel is running following reboot.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38424 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/7b8f3c72175c6a63a95cf2e219f8b78e2baad34eCVE reference, Linux
- https://git.kernel.org/stable/c/507c9a595bad3abd107c6a8857d7fd125d89f386CVE reference, Linux
- https://git.kernel.org/stable/c/a9f6aab7910a0ef2895797f15c947f6d1053160fCVE reference, Linux
- https://git.kernel.org/stable/c/975ffddfa2e19823c719459d2364fcaa17673964CVE reference, Linux
- https://git.kernel.org/stable/c/2ee6044a693735396bb47eeaba1ac3ae26c1c99bCVE reference, Linux
- https://git.kernel.org/stable/c/456019adaa2f5366b89c868dea9b483179bece54CVE reference, Linux
- https://git.kernel.org/stable/c/7311970d07c4606362081250da95f2c7901fc0dbCVE reference, Linux
- https://git.kernel.org/stable/c/4f6fc782128355931527cefe3eb45338abd8ab39CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.