{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2025-39821",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2025-39821",
    "idYear": 2025,
    "status": "PUBLISHED",
    "publishedAt": "2025-09-16T13:00:20.805Z",
    "updatedAt": "2026-08-05T12:05:25.973Z",
    "importedAt": "2026-10-24T01:57:34.152Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "perf: Avoid undefined behavior from stopping/starting inactive events",
      "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf: Avoid undefined behavior from stopping/starting inactive events\n\nCalling pmu->start()/stop() on perf events in PERF_EVENT_STATE_OFF can\nleave event->hw.idx at -1. When PMU drivers later attempt to use this\nnegative index as a shift exponent in bitwise operations, it leads to UBSAN\nshift-out-of-bounds reports.\n\nThe issue is a logical flaw in how event groups handle throttling when some\nmembers are intentionally disabled. Based on the analysis and the\nreproducer provided by Mark Rutland (this issue on both arm64 and x86-64).\n\nThe scenario unfolds as follows:\n\n 1. A group leader event is configured with a very aggressive sampling\n    period (e.g., sample_period = 1). This causes frequent interrupts and\n    triggers the throttling mechanism.\n 2. A child event in the same group is created in a disabled state\n    (.disabled = 1). This event remains in PERF_EVENT_STATE_OFF.\n    Since it hasn't been scheduled onto the PMU, its event->hw.idx remains\n    initialized at -1.\n 3. When throttling occurs, perf_event_throttle_group() and later\n    perf_event_unthrottle_group() iterate through all siblings, including\n    the disabled child event.\n 4. perf_event_throttle()/unthrottle() are called on this inactive child\n    event, which then call event->pmu->start()/stop().\n 5. The PMU driver receives the event with hw.idx == -1 and attempts to\n    use it as a shift exponent. e.g., in macros like PMCNTENSET(idx),\n    leading to the UBSAN report.\n\nThe throttling mechanism attempts to start/stop events that are not\nactively scheduled on the hardware.\n\nMove the state check into perf_event_throttle()/perf_event_unthrottle() so\nthat inactive events are skipped entirely. This ensures only active events\nwith a valid hw.idx are processed, preventing undefined behavior and\nsilencing UBSAN warnings. The corrected check ensures true before\nproceeding with PMU operations.\n\nThe problem can be reproduced with the syzkaller reproducer:",
      "affected": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "9734e25fbf5ae68eb04234b2cd14a4b36ab89141",
              "status": "affected",
              "versionType": "git",
              "lessThan": "d689135aa9c5e4e0eab5a92bbe35dab0c8d6677f"
            },
            {
              "version": "9734e25fbf5ae68eb04234b2cd14a4b36ab89141",
              "status": "affected",
              "versionType": "git",
              "lessThan": "b64fdd422a85025b5e91ead794db9d3ef970e369"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "versions": [
            {
              "version": "6.16",
              "status": "affected"
            },
            {
              "version": "0",
              "status": "unaffected",
              "versionType": "semver",
              "lessThan": "6.16"
            },
            {
              "version": "6.16.5",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.16.*"
            },
            {
              "version": "6.17",
              "status": "unaffected",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ]
        }
      ]
    }
  }
}