{"id":"CVE-2025-21895","title":"perf/core: Order the PMU list to fix warning about unordered pmu_ctx_list","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nperf/core: Order the PMU list to fix warning about unordered pmu_ctx_list\n\nSyskaller triggers a warning due to prev_epc->pmu != next_epc->pmu in\nperf_event_swap_task_ct…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= bd27568117664b8b3e259721393df420ed51f57b < f0c3971405cef6892844016aa710121a02da3a23","Linux >= bd27568117664b8b3e259721393df420ed51f57b < 7d582eb6e4e100959ba07083d7563453c8c2a343","Linux >= bd27568117664b8b3e259721393df420ed51f57b < 3e812a70732d84b7873cea61a7f6349b9a9dcbf5","Linux >= bd27568117664b8b3e259721393df420ed51f57b < 2016066c66192a99d9e0ebf433789c490a6785a2","Linux 6.2"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-05T20:36:28.120495Z"},"published":"2025-04-01","updated":"2026-11-05","sourceUpdated":"2026-11-05T20:41:47.071Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-21895","references":[{"url":"https://git.kernel.org/stable/c/f0c3971405cef6892844016aa710121a02da3a23"},{"url":"https://git.kernel.org/stable/c/7d582eb6e4e100959ba07083d7563453c8c2a343"},{"url":"https://git.kernel.org/stable/c/3e812a70732d84b7873cea61a7f6349b9a9dcbf5"},{"url":"https://git.kernel.org/stable/c/2016066c66192a99d9e0ebf433789c490a6785a2"}],"tags":["cve.org"],"epss":0.00148,"epssPercentile":0.0401,"ingestedAt":"2026-11-05T22:38:31.853Z","slug":"CVE-2025-21895","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nperf/core: Order the PMU list to fix warning about unordered pmu_ctx_list\n\nSyskaller triggers a warning due to prev_epc->pmu != next_epc->pmu in\nperf_event_swap_task_ctx_data(). vmcore shows that two lists have the same\nperf_event_pmu_context, but not in the same order.\n\nThe problem is that the order of pmu_ctx_list for the parent is impacted by\nthe time when an event/PMU is added. While the order for a child is\nimpacted by the event order in the pinned_groups and flexible_groups. So\nthe order of pmu_ctx_list in the parent and child may be different.\n\nTo fix this problem, insert the perf_event_pmu_context to its proper place\nafter iteration of the pmu_ctx_list.\n\nThe follow testcase can trigger above warning:\n\n # perf record -e cycles --call-graph lbr -- taskset -c 3 ./a.out &\n # perf stat -e cpu-clock,cs -p xxx // xxx is the pid of a.out\n\n test.c\n\n void main() {\n        int count = 0;\n        pid_t pid;\n\n        printf(\"%d running\\n\", getpid());\n        sleep(30);\n        printf(\"running\\n\");\n\n        pid = fork();\n        if (pid == -1) {\n                printf(\"fork error\\n\");\n                return;\n        }\n        if (pid == 0) {\n                while (1) {\n                        count++;\n                }\n        } else {\n                while (1) {\n                        count++;\n                }\n        }\n }\n\nThe testcase first opens an LBR event, so it will allocate task_ctx_data,\nand then open tracepoint and software events, so the parent context will\nhave 3 different perf_event_pmu_contexts. On inheritance, child ctx will\ninsert the perf_event_pmu_context in another order and the warning will\ntrigger.\n\n[ mingo: Tidied up the changelog. ]\n\n## Affected\n\n- `Linux >= bd27568117664b8b3e259721393df420ed51f57b < f0c3971405cef6892844016aa710121a02da3a23`\n- `Linux >= bd27568117664b8b3e259721393df420ed51f57b < 7d582eb6e4e100959ba07083d7563453c8c2a343`\n- `Linux >= bd27568117664b8b3e259721393df420ed51f57b < 3e812a70732d84b7873cea61a7f6349b9a9dcbf5`\n- `Linux >= bd27568117664b8b3e259721393df420ed51f57b < 2016066c66192a99d9e0ebf433789c490a6785a2`\n- `Linux 6.2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}