CVE-2025-40327— perf/core: Fix system hang caused by cpu-clock usage
Possible ATT&CK Techniques 1AI
T1543.003 · Windows ServiceAffected Version Matrix 8
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 18dbcbfabfffc4a5d3ea10290c5ad27f22b0d240< 6b8c512811644cf2f5eaf6f44e928683c54127f0 | affected |
18dbcbfabfffc4a5d3ea10290c5ad27f22b0d240< eb3182ef0405ff2f6668fd3e5ff9883f60ce8801 | affected | ||
b2de0c9ce8e542b5cb4cd3944620d9dd1ea1f0ac | affected | ||
6.16.8< 6.17 | affected | ||
6.17 | affected | ||
< 6.17 | unaffected | ||
6.17.8≤ 6.17.* | unaffected | ||
6.18≤ * | unaffected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-40327
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
perf/core: Fix system hang caused by cpu-clock usage
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix system hang caused by cpu-clock usage cpu-clock usage by the async-profiler tool can trigger a system hang, which got bisected back to the following commit by Octavia Togami: 18dbcbfabfff ("perf: Fix the POLL_HUP delivery breakage") causes this issue The root cause of the hang is that cpu-clock is a special type of SW event which relies on hrtimers. The __perf_event_overflow() callback is invoked from the hrtimer handler for cpu-clock events, and __perf_event_overflow() tries to call cpu_clock_event_stop() to stop the event, which calls htimer_cancel() to cancel the hrtimer. But that's a recursion into the hrtimer code from a hrtimer handler, which (unsurprisingly) deadlocks. To fix this bug, use hrtimer_try_to_cancel() instead, and set the PERF_HES_STOPPED flag, which causes perf_swevent_hrtimer() to stop the event once it sees the PERF_HES_STOPPED flag. [ mingo: Fixed the comments and improved the changelog. ]
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于cpu-clock事件处理不当，可能导致系统挂起。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2025-40327
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-40327
请登录查看更多情报信息。
Same Patch Batch · Linux · 2025-12-09 · 152 CVEs total
| CVE-2025-40343 | 9.8 CRITICAL | nvmet-fc: avoid scheduling association deletion twice |
| CVE-2023-53794 | 9.8 CRITICAL | cifs: fix session state check in reconnect to avoid use-after-free issue |
| CVE-2022-50666 | 9.8 CRITICAL | RDMA/siw: Fix QP destroy to wait for all references dropped. |
| CVE-2023-53827 | 8.8 HIGH | Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp} |
| CVE-2023-53785 | 8.8 HIGH | mt76: mt7921: don't assume adequate headroom for SDIO headers |
| CVE-2023-53822 | 8.8 HIGH | wifi: ath11k: Ignore frags from uninitialized peer in dp. |
| CVE-2025-40336 | 8.8 HIGH | drm/gpusvm: fix hmm_pfn_to_map_order() usage |
| CVE-2025-40342 | 8.8 HIGH | nvme-fc: use lock accessing port_state and rport state |
| CVE-2025-40328 | 8.8 HIGH | smb: client: fix potential UAF in smb2_close_cached_fid() |
| CVE-2023-53851 | 8.4 HIGH | drm/msm/dp: Drop aux devices together with DP controller |
| CVE-2025-40337 | 8.2 HIGH | net: stmmac: Correctly handle Rx checksum offload errors |
| CVE-2022-50656 | 8.1 HIGH | nfc: pn533: Clear nfc_target before being used |
| CVE-2023-53803 | 8.1 HIGH | scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process() |
| CVE-2023-53804 | 7.8 HIGH | nilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode() |
| CVE-2023-53819 | 7.8 HIGH | amdgpu: validate offset_in_bo of drm_amdgpu_gem_va |
| CVE-2023-53816 | 7.8 HIGH | drm/amdkfd: fix potential kgd_mem UAFs |
| CVE-2023-53800 | 7.8 HIGH | ubi: Fix use-after-free when volume resizing failed |
| CVE-2023-53790 | 7.8 HIGH | bpf: Zeroing allocated object from slab in bpf memory allocator |
| CVE-2023-53795 | 7.8 HIGH | iommufd: IOMMUFD_DESTROY should not increase the refcount |
| CVE-2023-53810 | 7.8 HIGH | blk-mq: release crypto keyslot before reporting I/O complete |
Showing top 20 of 152 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
- CVE-2026-68450
btrfs: free mapping node on duplicate reloc root insert - CVE-2026-68449
ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion - CVE-2026-68448
ovl: check access to copy_file_range source with src mounter - CVE-2026-68447
drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to B - CVE-2026-68446
drm/vmwgfx: Validate vmw_surface_metadata::array_size
Same vendor: Linux
- CVE-2026-68450
btrfs: free mapping node on duplicate reloc root insert - CVE-2026-68449
ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion - CVE-2026-68448
ovl: check access to copy_file_range source with src mounter - CVE-2026-68447
drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to B - CVE-2026-68446
drm/vmwgfx: Validate vmw_surface_metadata::array_size
V. Comments for CVE-2025-40327
No comments yet