CVE-2025-38466 (GCVE-0-2025-38466)
Vulnerability from cvelistv5
Published
2025-07-25 15:27
Modified
2026-08-05 12:02
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: perf: Revert to requiring CAP_SYS_ADMIN for uprobes Jann reports that uprobes can be used destructively when used in the middle of an instruction. The kernel only verifies there is a valid instruction at the requested offset, but due to variable instruction length cannot determine if this is an instruction as seen by the intended execution stream. Additionally, Mark Rutland notes that on architectures that mix data in the text segment (like arm64), a similar things can be done if the data word is 'mistaken' for an instruction. As such, require CAP_SYS_ADMIN for uprobes.
References
Impacted products
Vendor Product Version
Linux Linux Version: c9e0924e5c2b59365f9c0d43ff8722e79ecf4088
Version: c9e0924e5c2b59365f9c0d43ff8722e79ecf4088
Version: c9e0924e5c2b59365f9c0d43ff8722e79ecf4088
Version: c9e0924e5c2b59365f9c0d43ff8722e79ecf4088
Version: c9e0924e5c2b59365f9c0d43ff8722e79ecf4088
Version: c9e0924e5c2b59365f9c0d43ff8722e79ecf4088
Version: c9e0924e5c2b59365f9c0d43ff8722e79ecf4088
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:38:29.560Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-14T12:42:06.381Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/events/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d7ef1afd5b3f43f4924326164cee5397b66abd9c",
              "status": "affected",
              "version": "c9e0924e5c2b59365f9c0d43ff8722e79ecf4088",
              "versionType": "git"
            },
            {
              "lessThan": "c0aec35f861fa746ca45aa816161c74352e6ada8",
              "status": "affected",
              "version": "c9e0924e5c2b59365f9c0d43ff8722e79ecf4088",
              "versionType": "git"
            },
            {
              "lessThan": "8e8bf7bc6aa6f583336c2fda280b6cea0aed5612",
              "status": "affected",
              "version": "c9e0924e5c2b59365f9c0d43ff8722e79ecf4088",
              "versionType": "git"
            },
            {
              "lessThan": "183bdb89af1b5193b1d1d9316986053b15ca6fa4",
              "status": "affected",
              "version": "c9e0924e5c2b59365f9c0d43ff8722e79ecf4088",
              "versionType": "git"
            },
            {
              "lessThan": "a0a8009083e569b5526c64f7d3f2a62baca95164",
              "status": "affected",
              "version": "c9e0924e5c2b59365f9c0d43ff8722e79ecf4088",
              "versionType": "git"
            },
            {
              "lessThan": "d5074256b642cdeb46a70ce2f15193e766edca68",
              "status": "affected",
              "version": "c9e0924e5c2b59365f9c0d43ff8722e79ecf4088",
              "versionType": "git"
            },
            {
              "lessThan": "ba677dbe77af5ffe6204e0f3f547f3ba059c6302",
              "status": "affected",
              "version": "c9e0924e5c2b59365f9c0d43ff8722e79ecf4088",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/events/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.8"
            },
            {
              "lessThan": "5.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.240",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.146",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.99",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.240",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.189",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.146",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.99",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.39",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.7",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf: Revert to requiring CAP_SYS_ADMIN for uprobes\n\nJann reports that uprobes can be used destructively when used in the\nmiddle of an instruction. The kernel only verifies there is a valid\ninstruction at the requested offset, but due to variable instruction\nlength cannot determine if this is an instruction as seen by the\nintended execution stream.\n\nAdditionally, Mark Rutland notes that on architectures that mix data\nin the text segment (like arm64), a similar things can be done if the\ndata word is \u0027mistaken\u0027 for an instruction.\n\nAs such, require CAP_SYS_ADMIN for uprobes."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The attack is performed entirely through the local `perf_event_open(2)` syscall with `attr.type = perf_uprobe.type` and an attacker-supplied `uprobe_path`/`probe_offset`. No network or physical access is involved.\nAC:L - Exploitation is fully deterministic \u2014 the attacker picks the file and the byte offset, and `arch_uprobe_analyze_insn()` accepts essentially any mid-instruction offset since the x86 decoder finds a valid instruction there. There is no race to win and no dependence on memory layout the attacker cannot control.\nPR:L - The pre-fix gate is `perfmon_capable()`, i.e. CAP_PERFMON \u2014 a deliberately non-administrative, \"principle of least privilege\" observability capability routinely delegated to ordinary developers, CI runners, profiling tools (`setcap cap_perfmon+ep /usr/bin/perf`) and monitoring agents precisely so they need not be root. The essence of this flaw is that this basic, non-admin privilege confers system-wide code-modification power, so it is not the \"significant/administrative control\" that PR:H describes.\nUI:N - `register_for_each_vma()` walks the inode\u0027s i_mmap tree and patches every mm already mapping the target file, so the attacker can corrupt an already-running root daemon (via `libc.so.6`, `sshd`, `systemd`) immediately. No victim action is required.\nS:U - The vulnerable component and the impacted resources \u2014 other processes\u0027 text and data \u2014 are both managed by the same Linux kernel security authority. This is a standard local privilege escalation, not a VM/IOMMU/sandbox boundary crossing.\nC:H - Writing an attacker-chosen `0xCC` mid-instruction lets the attacker neutralize security checks or redirect control flow inside root-owned processes and setuid binaries, and `ref_ctr_offset` supplies an additional arbitrary-offset write into their mappings. This yields code execution as root and hence disclosure of arbitrary system data.\nI:H - The attacker obtains attacker-placed byte corruption at any offset of any executable or shared library system-wide (plus an arbitrary 16-bit write primitive via `__update_ref_ctr()`), with no permission check on the target file. That is direct code-integrity destruction and privilege escalation to root.\nA:H - Corrupting an instruction in a widely mapped library such as `libc.so.6` immediately crashes or wedges every process mapping it, including init/systemd and other critical daemons, resulting in system-wide denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:02:07.957Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d7ef1afd5b3f43f4924326164cee5397b66abd9c"
        },
        {
          "url": "https://git.kernel.org/stable/c/c0aec35f861fa746ca45aa816161c74352e6ada8"
        },
        {
          "url": "https://git.kernel.org/stable/c/8e8bf7bc6aa6f583336c2fda280b6cea0aed5612"
        },
        {
          "url": "https://git.kernel.org/stable/c/183bdb89af1b5193b1d1d9316986053b15ca6fa4"
        },
        {
          "url": "https://git.kernel.org/stable/c/a0a8009083e569b5526c64f7d3f2a62baca95164"
        },
        {
          "url": "https://git.kernel.org/stable/c/d5074256b642cdeb46a70ce2f15193e766edca68"
        },
        {
          "url": "https://git.kernel.org/stable/c/ba677dbe77af5ffe6204e0f3f547f3ba059c6302"
        }
      ],
      "title": "perf: Revert to requiring CAP_SYS_ADMIN for uprobes",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38466",
    "datePublished": "2025-07-25T15:27:48.235Z",
    "dateReserved": "2025-04-16T04:51:24.020Z",
    "dateUpdated": "2026-08-05T12:02:07.957Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.