---
id: CVE-2025-21895
title: 'perf/core: Order the PMU list to fix warning about unordered pmu_ctx_list'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  perf/core: Order the PMU list to fix warning about unordered pmu_ctx_list

  Syskaller triggers a warning due to prev_epc->pmu != next_epc->pmu in
  perf_event_swap_task_ct…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= bd27568117664b8b3e259721393df420ed51f57b <
    f0c3971405cef6892844016aa710121a02da3a23
  - >-
    Linux >= bd27568117664b8b3e259721393df420ed51f57b <
    7d582eb6e4e100959ba07083d7563453c8c2a343
  - >-
    Linux >= bd27568117664b8b3e259721393df420ed51f57b <
    3e812a70732d84b7873cea61a7f6349b9a9dcbf5
  - >-
    Linux >= bd27568117664b8b3e259721393df420ed51f57b <
    2016066c66192a99d9e0ebf433789c490a6785a2
  - Linux 6.2
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T20:36:28.120495Z'
published: '2025-04-01'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T20:41:47.071Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-21895'
references:
  - url: 'https://git.kernel.org/stable/c/f0c3971405cef6892844016aa710121a02da3a23'
  - url: 'https://git.kernel.org/stable/c/7d582eb6e4e100959ba07083d7563453c8c2a343'
  - url: 'https://git.kernel.org/stable/c/3e812a70732d84b7873cea61a7f6349b9a9dcbf5'
  - url: 'https://git.kernel.org/stable/c/2016066c66192a99d9e0ebf433789c490a6785a2'
tags:
  - cve.org
epss: 0.00148
epssPercentile: 0.0401
ingestedAt: '2026-11-05T22:38:31.853Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

perf/core: Order the PMU list to fix warning about unordered pmu_ctx_list

Syskaller triggers a warning due to prev_epc->pmu != next_epc->pmu in
perf_event_swap_task_ctx_data(). vmcore shows that two lists have the same
perf_event_pmu_context, but not in the same order.

The problem is that the order of pmu_ctx_list for the parent is impacted by
the time when an event/PMU is added. While the order for a child is
impacted by the event order in the pinned_groups and flexible_groups. So
the order of pmu_ctx_list in the parent and child may be different.

To fix this problem, insert the perf_event_pmu_context to its proper place
after iteration of the pmu_ctx_list.

The follow testcase can trigger above warning:

 # perf record -e cycles --call-graph lbr -- taskset -c 3 ./a.out &
 # perf stat -e cpu-clock,cs -p xxx // xxx is the pid of a.out

 test.c

 void main() {
        int count = 0;
        pid_t pid;

        printf("%d running\n", getpid());
        sleep(30);
        printf("running\n");

        pid = fork();
        if (pid == -1) {
                printf("fork error\n");
                return;
        }
        if (pid == 0) {
                while (1) {
                        count++;
                }
        } else {
                while (1) {
                        count++;
                }
        }
 }

The testcase first opens an LBR event, so it will allocate task_ctx_data,
and then open tracepoint and software events, so the parent context will
have 3 different perf_event_pmu_contexts. On inheritance, child ctx will
insert the perf_event_pmu_context in another order and the warning will
trigger.

[ mingo: Tidied up the changelog. ]

## Affected

- `Linux >= bd27568117664b8b3e259721393df420ed51f57b < f0c3971405cef6892844016aa710121a02da3a23`
- `Linux >= bd27568117664b8b3e259721393df420ed51f57b < 7d582eb6e4e100959ba07083d7563453c8c2a343`
- `Linux >= bd27568117664b8b3e259721393df420ed51f57b < 3e812a70732d84b7873cea61a7f6349b9a9dcbf5`
- `Linux >= bd27568117664b8b3e259721393df420ed51f57b < 2016066c66192a99d9e0ebf433789c490a6785a2`
- `Linux 6.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.