CVE-2025-40327

Vulnerability

CVE-2025-40327 describes a deadlock in the Linux kernel's perf subsystem that can lead to a system hang. The issue occurs when the cpu-clock software event is used, for example by the async-profiler tool. The root cause is a recursive call into the hrtimer subsystem.

The hang was bisected to commit 18dbcbfabfff ("perf: Fix the POLL_HUP delivery breakage"). In the perf event overflow handler (__perf_event_overflow()), which runs from the hrtimer callback context for cpu-clock events, the kernel would call cpu_clock_event_stop(). This function in turn calls hrtimer_cancel(), which tries to synchronously cancel the very hrtimer that is currently running the callback. The attempted cancellation from within the timer's own context leads to a deadlock.

The fix replaces hrtimer_cancel() with hrtimer_try_to_cancel() and sets the PERF_HES_STOPPED flag. This allows the hrtimer to run to completion, and on the next callback invocation the event handler will see the stopped flag and properly stop the event without recursion [1].

Impact

A local attacker or unprivileged user running a profiling tool that uses cpu-clock events can trigger a system hang, resulting in a denial of service (DoS). No special privileges beyond access to the perf subsystem are required.

Mitigation

The patch has been merged into the Linux kernel stable tree. Users should apply the kernel update that includes commit eb3182ef0405 or update to a kernel version containing the fix [1].