Medium

CVE-2025-37747 — perf: Fix hang while freeing sigtrap event

In the Linux kernel, the following vulnerability has been resolved: perf: Fix hang while freeing sigtrap event Perf can hang while freeing a sigtrap event if a related deferred signal hadn't managed to be sent before the file got closed: perf_event_overflow() task_work_add(perf_pending_task) fput() task_work_add(____fput()) task_work_run() ____fput() perf_release() perf_event_release_kernel() _free_event() perf_pending_task_sync() task_work_cancel() -> FAILED rcuwait_wait_event() Once task_work_run() is running, the list of pending callbacks is removed from the task_struct and from this point on task_work_cancel() can't remove any pending and not yet started work items, hence the task_work_cancel() failure and the hang on rcuwait_wait_event(). Task work could be changed to remove one work at a time, so a work running on the current task can always cancel a pending one, however the wait / wake design is still subject to inverted dependencies when remote targets are involved, as pictured by Oleg: T1 T2 fd = perf_event_open(pid => T2->pid); fd = perf_event_open(pid => T1->pid); close(fd) close(fd) <IRQ> <IRQ> perf_event_overflow() perf_event_overflow() task_work_add(perf_pending_task) task_work_add(perf_pending_task) </IRQ> </IRQ> fput() fput() task_work_add(____fput()) task_work_add(____fput()) task_work_run() task_work_run() ____fput() ____fput() perf_release() perf_release() perf_event_release_kernel() perf_event_release_kernel() _free_event() _free_event() perf_pending_task_sync() perf_pending_task_sync() rcuwait_wait_event() rcuwait_wait_event() Therefore the only option left is to acquire the event reference count upon queueing the perf task work and release it from the task work, just like it was done before 3a5465418f5f ("perf: Fix event leak upon exec and file release") but without the leaks it fixed. Some adjustments are necessary to make it work: * A child event might dereference its parent upon freeing. Care must be taken to release the parent last. * Some places assuming the event doesn't have any reference held and therefore can be freed right away must instead put the reference and let the reference counting to its job.

Published May 1, 2025 · Updated Oct 21, 2026 · Sources: NIST National Vulnerability Database, CVE Program (cve.org) e CISA ADP, GitHub Security Advisories · CNA: Linux

Low

Who exploits it and how urgent it is

A 0–100 score combining confirmed exploitation, ransomware and APT use, public exploits, EPSS and severity.

No exploitation signal in the sources consulted so far.

How the score was calculated

EPSS 0.2% (30-day exploitation probability)+2
Technical severity (medium)+3

The score orders the patch queue; it does not replace your asset context (internet exposure, criticality, compensating controls).

Triage

Is it exploited, how likely is exploitation, what does it touch, and how severe do the sources call it.

Exploitation

Not confirmed

Not in CISA KEV — an absence of record, not proof it is unexploited.

EPSS FIRST

0.25%

ahead of 16% of scored CVEs · Oct 27, 2026

Affects

Linux

Linux and 1 more

CVSS base

5.5

Medium · 2 source(s)

Remediation

Fixes and mitigations documented by the sources — linked to the original advisory.

Documented patch — git.kernel.org (NIST National Vulnerability Database)
Documented patch — git.kernel.org (NIST National Vulnerability Database)
Documented patch — git.kernel.org (NIST National Vulnerability Database)
Documented patch — git.kernel.org (NIST National Vulnerability Database)

First 24 hours

Ordered from the record’s own fields — exposure first, because you cannot patch what you have not found. A rule-generated starting point.

Identify exposed assets running the affected vendor/product/version combinations (Linux Linux, Linux Linux Kernel).
Apply the fixed version or the patch documented under Remediation.
Search available logs for exploit probes, errors and authentication anomalies.

Affected scope

Vendor, product and versions as the sources word them.

Vendor	Product	Versions	Status	Source
Linux	Linux	≥ 3a5465418f5fd970e86a86c7f4075be262682840 and < 1267bd38f161c1a27d9b722de017027167a225a0version 6.11≥ 6.10.3 and < 6.11≥ 6.1.103 and < 6.2≥ 5.15.165 and < 5.16≥ 6.6.44 and < 6.6.160version f34d8307a73a18de5320fcc6f40403146d061891version ed2c202dac55423a52d7e2290f2888bf08b8ee99 and 5 more version 9ad46f1fef421d43cdab3a7d1744b2f43b54dae0≥ 3a5465418f5fd970e86a86c7f4075be262682840 and < 56799bc035658738f362acec3e7647bb84e68933≥ 3a5465418f5fd970e86a86c7f4075be262682840 and < 665b87b8f8b3aeb49083ef3b65c4953e7753fc12≥ 3a5465418f5fd970e86a86c7f4075be262682840 and < fa1827fa968c0674e9b6fca223fa9fb4da4493eb≥ 104e258a004037bc7dba9f6085c71dad6af57ad4 and < aae58a39ac4c63c3fa53536fb2504c9f1d0e1719	Vulnerable	CVE Program (cve.org) e CISA ADP
Linux	Linux Kernel	≥ 5.15.165 and < 5.16version 6.15-rc1≥ 6.14 and < 6.14.3≥ 6.13 and < 6.13.12≥ 6.10.3 and < 6.12.24≥ 6.6.44 and < 6.7≥ 6.1.103 and < 6.2	Vulnerable	NIST National Vulnerability Database

Attack characteristics

The CVSS vector, decoded. It describes the attack, not your exposure to it.

Attack vector

Local

Attack complexity

Low

Privileges required

Low

User interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Every base score collected

Sources score independently and may disagree; each row says who scored it and under which version.

Score	Version	Severity	Expl.	Impact	Scored by
5.5	CVSS 3.1	Medium	1.8	3.6	nvd@nist.gov via NIST National Vulnerability Database
5.5	CVSS 3.1	Medium	—	—	GitHub, Inc. via GitHub Security Advisories

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (score shown at the top: nvd@nist.gov)

EPSS over time FIRST

Oct 20, 2026 → Oct 27, 2026 · 8 reading(s) · max 0.25%

Detection

Read off the CVSS vector and the weakness class. Starting points, not tested rules.

Local/physical vector: focus on endpoint telemetry (EDR) from affected hosts.

endpoint telemetry (EDR)

Timeline

What happened to this CVE, newest first.

2026
Affected products added · linux/linux
Oct 21, 2026 · CVE Program (cve.org) e CISA ADP
Record published
Oct 21, 2026
Fix documented
Oct 21, 2026 · NIST National Vulnerability Database
Affected products added · linux/linux kernel
Oct 21, 2026 · NIST National Vulnerability Database
CVSS changed · 5.5
Oct 21, 2026 · NIST National Vulnerability Database
Source status changed · → Modified
Oct 21, 2026 · NIST National Vulnerability Database
Record created in this database
Oct 21, 2026 · Alertas do Telegram
2025
CVE published
May 1, 2025 · Linux

Source activity

Repeated readings are counted rather than listed.

2× References added · Oct 21, 2026 – Oct 21, 2026
1× Official description updated · Oct 21, 2026 – Oct 21, 2026

References

7 on the record

git.kernel.org/stable/c/fa1827fa968c0674e9b6fca223fa9fb4da4493eb
Patch, NIST National Vulnerability Database
git.kernel.org/stable/c/1267bd38f161c1a27d9b722de017027167a225a0
Patch, NIST National Vulnerability Database
git.kernel.org/stable/c/665b87b8f8b3aeb49083ef3b65c4953e7753fc12
Patch, NIST National Vulnerability Database
git.kernel.org/stable/c/56799bc035658738f362acec3e7647bb84e68933
Patch, NIST National Vulnerability Database
nvd.nist.gov/vuln/detail/CVE-2025-37747
GitHub Security Advisories
git.kernel.org/stable/c/aae58a39ac4c63c3fa53536fb2504c9f1d0e1719
NIST National Vulnerability Database
github.com/advisories/GHSA-g7p4-4259-746x
GitHub Security Advisories

Elsewhere on this site

Linux
every CVE for this vendor

Related CVEs (same products)

Unknown CVE-2026-99215 power: supply: core: prevent unregistering a power supply while a callback runs 5h
Unknown CVE-2026-99216 Drivers: hv: Don't reset VMBus connection state on error/exit paths 5h
Unknown CVE-2026-99214 drm/vc4: hdmi: Move packet RAM enable to PM runtime 5h
Unknown CVE-2026-99213 vsock: treat TCP_CLOSING as once-established 5h
Unknown CVE-2026-99212 net/rds: don't let the rdma_cm destroy an id RDS still owns on route failure 5h
Unknown CVE-2026-99211 netlink: reset skb headers before unicast and multicast filtering 5h

Not in any source we poll

Listed rather than left blank: an empty field and an unmeasured one look identical on screen, and only one is a reason to look elsewhere.

No CISA SSVC assessment.
No CWE classification.
No confirmed IOCs, IP addresses, domains, file hashes, or malware artifacts supplied.
No organization-specific asset inventory, compensating-control status, or patch deployment evidence supplied.
No exploit packet captures, log samples, or incident case IDs supplied.

Answered from this record

Text assembled only from the fields above — no additional claims.

What should defenders know first?

CVE-2025-37747 is "perf: Fix hang while freeing sigtrap event", rated Medium. It affects Linux (Linux); versions are in the scope table. It is not in CISA KEV, which does not rule out exploitation. CVSS 5.5 describes technical severity. EPSS 0.25% estimates the probability of exploitation in 30 days; neither replaces your asset context. First verify whether exposed or business-critical assets run the affected versions, apply vendor fixes or mitigations, and preserve logs for review.

Comments

Moderated technical discussion. Read the community guidelines.

No comments yet.