Linux Kernel PMU Context Ordering Vulnerability in perf Event Handling

Vulnerability

A vulnerability in the Linux kernel's performance monitoring unit (PMU) context handling has been addressed. The issue arose because the order of PMU context lists could differ between parent and child processes, leading to warnings about unordered PMU contexts. This discrepancy was caused by the timing of when events were added to the PMU list, which varied between parent and child processes. The vulnerability could be triggered by a specific sequence of performance monitoring events, as demonstrated in a provided test case.

Impact

The vulnerability could lead to performance monitoring events being mismanaged between parent and child processes, potentially causing incorrect performance data to be recorded or analyzed.

Reproduction

The vulnerability can be reproduced by using the 'perf' tool to record events while a program is running. The test case involves opening a performance event in one process, then forking a child process that inherits the PMU context. This process will trigger a warning about the PMU contexts being out of order, highlighting the vulnerability.

Added: Jun 9, 2025, 7:46 PM
Updated: Jun 9, 2025, 7:46 PM

Vulnerability Rating

Custom Algorithm
spread
9.0
impact
0.6
exploitability
4.3
remediation
0.0
relevance
0.0
threat
4.8
urgency
2.9
incentive
1.7

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.