CVE: CVE-2025-40042
Published: 2025-10-28
Description: In the Linux kernel, the following vulnerability has been resolved:

tracing: Fix race condition in kprobe initialization causing NULL pointer dereference

There is a critical race condition in kprobe initialization that can lead to
NULL pointer dereference and kernel crash.

[[PII_REDACTED]82] Unable to handle kernel paging request at virtual address 0000710a04630000
...
[[PII_REDACTED]14] pstate: 404003c9 (nZcv DAIF +PAN -UAO)
[[PII_REDACTED]39] pc : kprobe_perf_func+0x30/0x260
[[PII_REDACTED]43] lr : kprobe_dispatcher+0x44/0x60
[[PII_REDACTED]41] sp : ffffaeff4977fa40
[[PII_REDACTED]41] x29: ffffaeff4977fa40 x28: ffffaf015340e400
[[PII_REDACTED]37] x27: [PII_REDACTED] x26: [PII_REDACTED]
[[PII_REDACTED]57] x25: ffffaf029ed108a8 x24: ffffaf015340e528
[[PII_REDACTED]05] x23: ffffaeff4977fc50 x22: ffffaeff4977fc50
[[PII_REDACTED]54] x21: [PII_REDACTED] x20: ffffaeff4977fc50
[[PII_REDACTED]86] x19: ffffaf015340e400 x18: [PII_REDACTED]
[[PII_REDACTED]85] x17: [PII_REDACTED] x16: [PII_REDACTED]
[[PII_REDACTED]85] x15: [PII_REDACTED] x14: [PII_REDACTED]
[[PII_REDACTED]45] x13: [PII_REDACTED] x12: [PII_REDACTED]
[[PII_REDACTED]73] x11: [PII_REDACTED] x10: [PII_REDACTED]
[[PII_REDACTED]11] x9 : [PII_REDACTED] x8 : [PII_REDACTED]
[[PII_REDACTED]52] x7 : [PII_REDACTED] x6 : [PII_REDACTED]
[[PII_REDACTED]63] x5 : [PII_REDACTED] x4 : [PII_REDACTED]
[[PII_REDACTED]45] x3 : 0000710a04630000 x2 : [PII_REDACTED]
[[PII_REDACTED]21] x1 : ffffaeff4977fc50 x0 : 0000710a04630000
[[PII_REDACTED]10] Call trace:
[[PII_REDACTED]28]  kprobe_perf_func+0x30/0x260
[[PII_REDACTED]61]  kprobe_dispatcher+0x44/0x60
[[PII_REDACTED]96]  aggr_pre_handler+0x70/0xc8
[[PII_REDACTED]59]  kprobe_breakpoint_handler+0x140/0x1e0
[[PII_REDACTED]35]  brk_handler+0xbc/0xd8
[[PII_REDACTED]37]  do_debug_exception+0x84/0x138
[[PII_REDACTED]74]  el1_dbg+0x18/0x8c
[[PII_REDACTED]82]  security_file_permission+0x0/0xd0
[[PII_REDACTED]26]  vfs_write+0x70/0x1c0
[[PII_REDACTED]59]  ksys_write+0x5c/0xc8
[[PII_REDACTED]38]  __arm64_sys_write+0x24/0x30
[[PII_REDACTED]21]  el0_svc_common+0x78/0x130
[[PII_REDACTED]38]  el0_svc_handler+0x38/0x78
[[PII_REDACTED]34]  el0_svc+0x8/0x1b0

kernel/trace/trace_kprobe.c: 1308
0xffff3df8995039ec <kprobe_perf_func+0x2c>:     ldr     x21, [x24,#120]
include/linux/compiler.h: 294
0xffff3df8995039f0 <kprobe_perf_func+0x30>:     ldr     x1, [x21,x0]

kernel/trace/trace_kprobe.c
1308: head = this_cpu_ptr(call->perf_events);
1309: if (hlist_empty(head))
1310: 	return 0;

crash> struct trace_event_call -o
struct trace_event_call {
  ...
  [120] struct hlist_head *perf_events;  //(call->perf_event)
  ...
}

crash> struct trace_event_call ffffaf015340e528
struct trace_event_call {
  ...
  perf_events = 0xffff0ad5fa89f088, //this value is correct, but x21 = 0
  ...
}

Race Condition Analysis:

The race occurs between kprobe activation and perf_events initialization:

  CPU0                                    CPU1
  ====                                    ====
  perf_kprobe_init
    perf_trace_event_init
      tp_event->perf_events = list;(1)
      tp_event->class->reg (2)← KPROBE ACTIVE
                                          Debug exception triggers
                                          ...
                                          kprobe_dispatcher
                                            kprobe_perf_func (tk->tp.flags & TP_FLAG_PROFILE)
                                              head = this_cpu_ptr(call->perf_events)(3)
                                              (perf_events is still NULL)

Problem:
1. CPU0 executes (1) assigning tp_event->perf_events = list
2. CPU0 executes (2) enabling kprobe functionality via class->reg()
3. CPU1 triggers and reaches kprobe_dispatcher
4. CPU1 checks TP_FLAG_PROFILE - condition passes (step 2 completed)
5. CPU1 calls kprobe_perf_func() and crashes at (3) because
   call->perf_events is still NULL

CPU1 sees that kprobe functionality is enabled but does not see that
perf_events has been assigned.

Add pairing read an
---truncated---
References: https://git.kernel.org/stable/c/07926ce598a95de6fd874a74fb510e2ebdfd0aae; https://git.kernel.org/stable/c/0fa388ab2c290ef1115ff88ae88e881d0fb2db02; https://git.kernel.org/stable/c/1a301228c0a8aedc3154fb1a274456f487416b96