CVE-2025-37936 is a vulnerability identified in the Linux kernel's handling of the Performance Monitoring Unit (PMU) events within Kernel-based Virtual Machine (KVM) guests on x86 Intel architectures. Specifically, the issue arises from improper masking of the MSR_IA32_PEBS_ENABLE Model-Specific Register (MSR) value that is loaded during VM-Entry for a KVM guest's virtual CPU (vCPU). The vulnerability stems from the kernel consulting only the host's mask values when enabling Precise Event-Based Sampling (PEBS) for guest virtual machines, without properly considering the guest's requested PEBS_ENABLE settings. This results in the guest VM running with PEBS enabled even if it did not request it. Because KVM proxies guest PMU events through the host's perf subsystem, the kernel cannot distinguish between events created by host userspace and those created on behalf of the guest. Consequently, if PEBS is enabled unexpectedly, the guest may experience near-infinite page faults (#PFs), particularly if it has not initialized MSR_IA32_DS_AREA, which PEBS uses to record events. This leads to guest crashes and instability. The issue is reproducible by running the `perf kvm top` command on affected kernel versions prior to the fix, where userspace creates guest-only PEBS events that the kernel misattributes. Although this behavior can be viewed as a userspace bug—since enabling PEBS on guest-only events is inherently problematic—the kernel patch restricts PEBS usage to guest-owned events to prevent such crashes. The vulnerability does not pose a risk to the host system but can cause denial of service within guest VMs. The fix involves proper masking of the PEBS_ENABLE MSR value with the vCPU's desired settings during VM-Entry, preventing unintended PEBS activation. This vulnerability affects Linux kernel versions identified by the commit hash c59a1f106f5cd4843c097069ff1bb2ad72103a67 and was published on May 20, 2025. No known exploits are currently reported in the wild, and no CVSS score has been assigned.

For European organizations utilizing Linux-based virtualization environments, particularly those deploying KVM for guest virtual machines on Intel x86 hardware, this vulnerability can lead to guest VM instability and crashes due to unexpected PEBS activation. The primary impact is denial of service within affected guest VMs, which can disrupt critical workloads, testing environments, or production services running inside virtual machines. While the host system remains unaffected, the inability to reliably run guest VMs can degrade service availability and increase operational overhead. Organizations relying on performance monitoring tools like 'perf' in conjunction with KVM may inadvertently trigger this issue, complicating performance analysis and debugging efforts. The impact is more pronounced in environments with high virtualization density or those running sensitive applications inside VMs that do not initialize PEBS-related MSRs properly. Although no direct confidentiality or integrity compromise is evident, the availability impact on guest VMs can have cascading effects on business continuity, especially in sectors such as finance, telecommunications, and cloud service providers prevalent in Europe.

To mitigate CVE-2025-37936, European organizations should: 1) Apply the Linux kernel patches that correctly mask the MSR_IA32_PEBS_ENABLE value during VM-Entry to align with the guest vCPU's requested settings. This patch prevents unintended PEBS activation and guest crashes. 2) Avoid running outdated kernel versions identified by the vulnerable commit hash (c59a1f106f5cd4843c097069ff1bb2ad72103a67) and upgrade to the latest stable kernel releases containing the fix. 3) Review and audit the use of performance monitoring tools like 'perf' in virtualized environments to ensure they do not create guest-only PEBS events that could trigger the issue. 4) Implement monitoring to detect unusual guest VM crashes or page fault storms indicative of this vulnerability. 5) Educate system administrators and DevOps teams about the interaction between perf events and KVM guests to prevent inadvertent misuse. 6) For environments where immediate patching is not feasible, consider disabling PEBS-related performance monitoring for guests as a temporary workaround, understanding the trade-offs in performance analysis capabilities. 7) Engage with Linux distribution vendors for backported fixes and security advisories relevant to their kernel versions. These steps go beyond generic advice by focusing on kernel patching, performance tool usage, and operational monitoring specific to this vulnerability.