---
id: CVE-2025-38424
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  perf: Fix sample vs do_exit()

  Baisheng Gao reported an ARM64 crash, which Mark decoded as being a
  synchronous external abort -- most likely due to trying to access
  MMI…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  perf: Fix sample vs do_exit()

  Baisheng Gao reported an ARM64 crash, which Mark decoded as being a
  synchronous external abort -- most likely due to trying to access
  MMI…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 3.7, < 5.4.295'
  - 'linux_kernel >= 5.5, < 5.10.239'
  - 'linux_kernel >= 5.11, < 5.15.186'
  - 'linux_kernel >= 5.16, < 6.1.142'
  - 'linux_kernel >= 6.2, < 6.6.95'
  - 'linux_kernel >= 6.7, < 6.12.35'
  - 'linux_kernel >= 6.13, < 6.15.4'
  - linux_kernel = 6.16
  - debian_linux = 11.0
patched:
  - linux_kernel 6.15.4
published: '2025-07-25'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T22:18:40.607'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-38424'
references:
  - url: 'https://git.kernel.org/stable/c/2ee6044a693735396bb47eeaba1ac3ae26c1c99b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/456019adaa2f5366b89c868dea9b483179bece54'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/4f6fc782128355931527cefe3eb45338abd8ab39'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/507c9a595bad3abd107c6a8857d7fd125d89f386'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/7311970d07c4606362081250da95f2c7901fc0db'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/7b8f3c72175c6a63a95cf2e219f8b78e2baad34e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/975ffddfa2e19823c719459d2364fcaa17673964'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a9f6aab7910a0ef2895797f15c947f6d1053160f'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
  - cve.org
epss: 0.00219
epssPercentile: 0.12293
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-15T21:50:16.738401Z'
ingestedAt: '2026-10-15T22:48:25.507Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

perf: Fix sample vs do_exit()

Baisheng Gao reported an ARM64 crash, which Mark decoded as being a
synchronous external abort -- most likely due to trying to access
MMIO in bad ways.

The crash further shows perf trying to do a user stack sample while in
exit_mmap()'s tlb_finish_mmu() -- i.e. while tearing down the address
space it is trying to access.

It turns out that we stop perf after we tear down the userspace mm; a
receipie for disaster, since perf likes to access userspace for
various reasons.

Flip this order by moving up where we stop perf in do_exit().

Additionally, harden PERF_SAMPLE_CALLCHAIN and PERF_SAMPLE_STACK_USER
to abort when the current task does not have an mm (exit_mm() makes
sure to set current->mm = NULL; before commencing with the actual
teardown). Such that CPU wide events don't trip on this same problem.

## Affected

- `linux_kernel >= 3.7, < 5.4.295`
- `linux_kernel >= 5.5, < 5.10.239`
- `linux_kernel >= 5.11, < 5.15.186`
- `linux_kernel >= 5.16, < 6.1.142`
- `linux_kernel >= 6.2, < 6.6.95`
- `linux_kernel >= 6.7, < 6.12.35`
- `linux_kernel >= 6.13, < 6.15.4`
- `linux_kernel = 6.16`
- `debian_linux = 11.0`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.15.4`