CVE-2025-21889

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

perf/core: Add RCU read lock protection to perf_iterate_ctx()

The perf_iterate_ctx() function performs RCU list traversal but

currently lacks RCU read lock protection. This causes lockdep warnings

when running perf probe with unshare(1) under CONFIG_PROVE_RCU_LIST=y:

WARNING: suspicious RCU usage

kernel/events/core.c:8168 RCU-list traversed in non-reader section!!

Call Trace:

lockdep_rcu_suspicious

? perf_event_addr_filters_apply

perf_iterate_ctx

perf_event_exec

begin_new_exec

? load_elf_phdrs

load_elf_binary

? lock_acquire

? find_held_lock

? bprm_execve

bprm_execve

do_execveat_common.isra.0

__x64_sys_execve

do_syscall_64

entry_SYSCALL_64_after_hwframe

This protection was previously present but was removed in commit

bd2756811766 ("perf: Rewrite core context handling"). Add back the

necessary rcu_read_lock()/rcu_read_unlock() pair around

perf_iterate_ctx() call in pe

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References