CVE-2025-38322

Vulnerability

Analysis

CVE-2025-38322 is a kernel vulnerability in the Linux perf subsystem affecting Intel processors. The root cause is a logic error introduced by commit f9bdf1f95339, which replaced a correct is_topdown_count() check with is_topdown_event(). This change caused the icl_update_topdown_event() function to be invoked on Intel E-cores (CPUs 16-23 on a RaptorLake machine) that do not support the perf metrics feature, leading to a general protection fault and hard-lockup crash [1][2].

Exploitation and

Impact

An attacker with local access and the ability to trigger perf events (such as via the perf_fuzzer tool) could exploit this vulnerability to cause a denial of service (DoS) by crashing the system. The crash manifests as a hard-lockup on the affected CPU core, requiring a reboot to recover. No special privileges or complex attack chains are needed beyond local user access to the perf subsystem [1][3].

Mitigation

The Linux kernel community has released a fix in the stable kernel tree (commit a85cc69acdcb) that restores the correct is_topdown_count() check, ensuring topdown event handling only occurs on cores that support it [3][4]. The vulnerability is fixed in Linux kernel versions that include this commit. Affected users should update their kernels to the latest stable release. The Siemens advisory (SSA-032379) also lists this CVE as affecting certain industrial products, referencing the kernel fix [1].