LiveActive security incident?Get immediate response
CVE Record

CVE-2025-38564: perf/core: Handle buffer mapping fail correctly in perf_mmap()

In the Linux kernel, the following vulnerability has been resolved: perf/core: Handle buffer mapping fail correctly in perf_mmap() After successful allocation of a buffer or a successful attachment to an existing buffer perf_mmap() tries to map the buffer read only into the page table. If that fails, the already set up page table entries are zapped, but the other perf specific side effects of that failure are not handled. The calling code just cleans up the VMA and does not invoke perf_mmap_close(). This leaks reference counts, corrupts user->vm accounting and also results in an unbalanced invocation of event::event_mapped(). Cure this by moving the event::event_mapped() invocation before the map_range() call so that on map_range() failure perf_mmap_close() can be invoked without causing an unbalanced event::event_unmapped() call. perf_mmap_close() undoes the reference counts and eventually frees buffers.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2025-38564 is a Linux kernel perf subsystem flaw triggered when mapping a perf buffer fails. The source describes leaked reference counts, corrupted user VM accounting, and mismatched mapped/unmapped event handling. No CVSS score, CWE, exploitation, or business impact rating is provided.

Executive priority

Treat this as a kernel hygiene update with uncertain severity. Prioritize patch validation on shared Linux systems and internet-facing infrastructure baselines, but avoid emergency escalation unless vendor advisories add severity or exploitation evidence.

Technical view

In perf_mmap(), a buffer allocation or attachment can succeed before read-only page-table mapping fails. Cleanup zaps page-table entries but previously skipped perf_mmap_close(), leaving perf-specific side effects unbalanced. The fix reorders event_mapped() so perf_mmap_close() can safely unwind references and buffers on map_range() failure.

Likely exposure

Exposure is limited to Linux kernels identified by the CVE record as affected, including listed versions 6.14, 6.15.10, 6.16.1, and 6.17. The source does not define exact distro package status or attacker prerequisites.

Exploitation context

The CVE is not listed as KEV in the provided bundle, and no cited source states active exploitation. The described issue appears local to kernel perf buffer mmap failure handling; the source does not support remote exploit claims.

Researcher notes

The available evidence identifies a cleanup-path bug in perf_mmap() after map_range() failure. The record lacks CVSS, CWE, exploitability details, and distro-specific affected ranges, so validation should focus on source commits and vendor kernel backports.

Mitigation direction

  • Apply Linux kernel or distribution updates that include the referenced stable fixes.
  • Check vendor advisories for package-specific fixed versions and reboot requirements.
  • Prioritize systems where untrusted users can access perf functionality.
  • If updates are delayed, review vendor guidance for perf_event access restrictions.

Validation and detection

  • Inventory running kernel versions across affected Linux hosts.
  • Confirm whether deployed kernels include the referenced stable commits.
  • Review distribution security advisories for CVE-2025-38564 package mapping.
  • Check perf access policy on multi-user or shared compute systems.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-38564 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
4Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxb709eb872e19a19607bbb6d2975bc264d59735cf, b709eb872e19a19607bbb6d2975bc264d59735cf, b709eb872e19a19607bbb6d2975bc264d59735cfunaffected
LinuxLinux6.14, 0, 6.15.10, 6.16.1, 6.17affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.