CVE-2025-37878

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

perf/core: Fix WARN_ON(!ctx) in __free_event() for partial init

Move the get_ctx(child_ctx) call and the child_event->ctx assignment to

occur immediately after the child event is allocated. Ensure that

child_event->ctx is non-NULL before any subsequent error path within

inherit_event calls free_event(), satisfying the assumptions of the

cleanup code.

Details:

There's no clear Fixes tag, because this bug is a side-effect of

multiple interacting commits over time (up to 15 years old), not

a single regression.

The code initially incremented refcount then assigned context

immediately after the child_event was created. Later, an early

validity check for child_event was added before the

refcount/assignment. Even later, a WARN_ON_ONCE() cleanup check was

added, assuming event->ctx is valid if the pmu_ctx is valid.

The problem is that the WARN_ON_ONCE() could trigger after the initial

check passed but before child_event->

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References