VulnerabilityPublished 19 Aug 2025Updated 5 Nov 2026

CVE-2025-38563: Linux kernel · perf/core: Prevent VMA split of buffer mappings

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in ff668930871e0198c7f4e325058b8b7c286787bd : update Linux kernel when convenient.

Data as of 5 Nov 2026, 23:23 UTC

Severity

Unrated

Rated by Threat Radar · No CVSS score from NVD or the CNA

Thin evidence

One scorer or none

EPSS

0.4% chance of exploitation in 30 days – higher than 34% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

Exploitation: No evidence of active exploitation and no public proof of concept
Automatable: Attackers cannot reliably automate steps 1–4 of the kill chain
Technical impact: Limited control over the software or limited information exposure

CISA SSVC assessment, 2026-11-05.

Patch

Available – fixed in ff668930871e0198c7f4e325058b8b7c286787bd, e529888b7e8092912dd8789bdfc76685ccd2ff5f, e4346ffec2c44d6b0be834d59b20632b5bb5729e +6

Exploitation evidence

Disclosed: evidence found.
CVE published 19 Aug 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 5 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 45bfb2e50471abbbfd83d40d28c986078b0d24ff, < ff668930871e0198c7f4e325058b8b7c286787bd	Fixed in ff668930871e0198c7f4e325058b8b7c286787bd
LinuxLinux	Affected ≥ 45bfb2e50471abbbfd83d40d28c986078b0d24ff, < e529888b7e8092912dd8789bdfc76685ccd2ff5f	Fixed in e529888b7e8092912dd8789bdfc76685ccd2ff5f
LinuxLinux	Affected ≥ 45bfb2e50471abbbfd83d40d28c986078b0d24ff, < e4346ffec2c44d6b0be834d59b20632b5bb5729e	Fixed in e4346ffec2c44d6b0be834d59b20632b5bb5729e
LinuxLinux	Affected ≥ 45bfb2e50471abbbfd83d40d28c986078b0d24ff, < d52451a9210f2e5a079ba052918c93563518a9ff	Fixed in d52451a9210f2e5a079ba052918c93563518a9ff
LinuxLinux	Affected ≥ 45bfb2e50471abbbfd83d40d28c986078b0d24ff, < b024d7b56c77191cde544f838debb7f8451cd0d6	Fixed in b024d7b56c77191cde544f838debb7f8451cd0d6
LinuxLinux	Affected ≥ 45bfb2e50471abbbfd83d40d28c986078b0d24ff, < 65311aad4c808bedad0c05d9bb8b06c47dae73eb	Fixed in 65311aad4c808bedad0c05d9bb8b06c47dae73eb

Description

In the Linux kernel, the following vulnerability has been resolved: perf/core: Prevent VMA split of buffer mappings The perf mmap code is careful about mmap()'ing the user page with the ringbuffer and additionally the auxiliary buffer, when the event supports it. Once the first mapping is established, subsequent mapping have to use the same offset and the same size in both cases. The reference counting for the ringbuffer and the auxiliary buffer depends on this being correct. Though perf does not prevent that a related mapping is split via mmap(2), munmap(2) or mremap(2). A split of a VMA results in perf_mmap_open() calls, which take reference counts, but then the subsequent perf_mmap_close() calls are not longer fulfilling the offset and size checks. This leads to reference count leaks. As perf already has the requirement for subsequent mappings to match the initial mapping, the obvious consequence is that VMA splits, caused by resizing of a mapping or partial unmapping, have to be prevented. Implement the vm_operations_struct::may_split() callback and return unconditionally -EINVAL. That ensures that the mapping offsets and sizes cannot be changed after the fact. Remapping to a different fixed address with the same size is still possible as it takes the references for the new mapping and drops those of the old mapping.

References

Community reviews

Loading reviews…