CVE-2025-37884

MEDIUM

MEDIUM Priority: 0.01 BB Relevance: 36/100

Published: 2025-05-09 Modified: 2026-11-05 First seen: 2026-11-05 Status: active

Attack Surface

Low Complexity No Interaction

CVSS Vector Breakdown

AV: Local

AC: Low

PR: Low

UI: None

S: Unchanged

C: None

I: None

A: High

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix deadlock between rcu_tasks_trace and event_mutex. Fix the following deadlock: CPU A _free_event() perf_kprobe_destroy() mutex_lock(&event_mutex) perf_trace_event_unreg() synchronize_rcu_tasks_trace() There are several paths where _free_event() grabs event_mutex and calls sync_rcu_tasks_trace. Above is one such case. CPU B bpf_prog_test_run_syscall() rcu_read_lock_trace() bpf_prog_run_pin_on_cpu() bpf_prog_load() bpf_tracing_func_proto() trace_set_clr_event() mutex_lock(&event_mutex) Delegate trace_set_clr_event() to workqueue to avoid such lock dependency.

Weakness Classification (1)

CWE-667

Affected Software (5)

Vendor	Product	Version
Linux	Linux	a363d27cdbc2bc2d1899b5a1520b64e3590fcd9a < 45286680b385f2592db3003554872388dee66d68
Linux	Linux	a363d27cdbc2bc2d1899b5a1520b64e3590fcd9a < 4580f4e0ebdf8dc8d506ae926b88510395a0c1d1
Linux	Linux	6.13
debian	debian_linux	11.0
linux	linux_kernel	< 6.1.136