CVE-2025-68375

When intel_pmu_drain_pebs_icl() drains PEBS records, it may call perf_event_overflow() to process the last PEBS record. This function can trigger interrupt throttling via perf_event_throttle_group(), which stops all events in the group by calling x86_pmu_stop(). The side effect of stopping events is that all corresponding event pointers in cpuc->events[] array are cleared to NULL.

If two PEBS events (event a and event b) are in a group, and perf_event_overflow() processes the last PEBS record of event a, throttling clears pointers for both events. When the drain function then tries to process the last PEBS record of event b, it accesses a NULL pointer, leading to a crash.

The vulnerability can be triggered on systems with Intel processors that support PEBS (Precise Event Based Sampling) and when multiple PEBS events are grouped together. The attack surface is local, requiring the ability to set up such event groups, typically via the perf subsystem, which may be available to unprivileged users depending on configuration.

The impact is a denial of service (system crash) due to a NULL pointer dereference. An attacker with local access and the ability to create perf events could exploit this to cause a kernel panic.

The fix moves the clearing of cpuc->events[] from x86_pmu_stop() to x86_pmu_del(), which is safe because cpuc->active_mask or cpuc->pebs_enabled is always checked before accessing the event pointer from cpuc->events[]. The patch has been applied to the stable kernel tree as commit cf69b99805c2 [1].