CVE-2025-37747 is a vulnerability identified in the Linux kernel's perf subsystem, specifically related to the handling of sigtrap events during resource cleanup. The issue arises when perf attempts to free a sigtrap event while a deferred signal associated with that event has not yet been delivered, leading to a hang condition. The root cause is a race condition in the task work queue management: when task_work_run() begins executing, it removes the list of pending callbacks from the task_struct, preventing task_work_cancel() from removing any pending but not yet started work items. This results in a failure of task_work_cancel() and causes the system to hang on rcuwait_wait_event(). The vulnerability involves complex interactions between task_work_add(), fput(), and perf_event_overflow() functions, where closing a file descriptor related to perf events triggers a sequence of callbacks that ultimately lead to the hang. Attempts to cancel pending work fail because the work list is already removed, creating inverted dependencies especially when multiple tasks (threads) are involved, as illustrated by the example with two tasks opening and closing perf event file descriptors referencing each other. The fix involves reintroducing reference counting on perf events when queueing task work, ensuring that events are not prematurely freed and that parent-child event relationships are respected during cleanup. This approach prevents the race condition by maintaining proper lifecycle management of perf events during asynchronous task work execution. This vulnerability affects multiple Linux kernel versions identified by specific commit hashes, indicating it spans several recent kernel releases. No known exploits are reported in the wild yet, and no CVSS score has been assigned. The issue is primarily a denial-of-service (DoS) condition caused by kernel hangs, which can impact system stability and availability.

For European organizations relying on Linux-based systems, especially servers and infrastructure running performance monitoring tools or custom applications utilizing the perf subsystem, this vulnerability poses a risk of system hangs leading to denial of service. Critical infrastructure, cloud service providers, and enterprises with Linux-based monitoring or debugging tools could experience unexpected kernel hangs, resulting in downtime or degraded service availability. The impact is particularly significant for environments with high concurrency and frequent perf event usage, such as data centers, telecom operators, and financial institutions that depend on real-time performance monitoring. A kernel hang can disrupt business operations, cause loss of productivity, and potentially trigger cascading failures in dependent services. While this vulnerability does not directly lead to privilege escalation or data breach, the availability impact can indirectly affect confidentiality and integrity by interrupting security monitoring tools and incident response capabilities. Organizations with stringent uptime requirements and service level agreements (SLAs) must prioritize addressing this issue to maintain operational continuity.

To mitigate CVE-2025-37747, European organizations should: 1. Apply the official Linux kernel patches that address this perf subsystem race condition as soon as they become available from trusted sources or Linux distribution vendors. 2. Monitor kernel updates and subscribe to security advisories from Linux distributions commonly used within the organization (e.g., Debian, Ubuntu, Red Hat, SUSE) to ensure timely deployment of fixes. 3. Temporarily limit or audit the use of perf event monitoring tools in production environments where possible, especially in high-concurrency scenarios, to reduce exposure until patches are applied. 4. Implement robust kernel crash and hang detection mechanisms, such as watchdog timers and automated system recovery procedures, to minimize downtime impact. 5. Conduct thorough testing of kernel updates in staging environments to verify stability and compatibility with existing monitoring and performance tools before production rollout. 6. Educate system administrators and DevOps teams about this specific vulnerability to recognize symptoms of kernel hangs related to perf events and respond promptly. 7. Consider isolating critical monitoring workloads or deploying them on dedicated systems to contain potential impact.