perf/x86/intel: Fix crash in icl_update_topdown_event()
In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: Fix crash in icl_update_topdown_event() The perf_fuzzer found a hard-lockup crash on a RaptorLake machine: Oops: general protection fault, maybe for address 0xffff89aeceab400: 0000 CPU: 23 UID: 0 PID: 0 Comm: swapper/23 Tainted: [W]=WARN Hardware name: Dell Inc. Precision 9660/0VJ762 RIP: 0010:native_read_pmc+0x7/0x40 Code: cc e8 8d a9 01 00 48 89 03 5b cd cc cc cc cc 0f 1f ... RSP: 000:fffb03100273de8 EFLAGS: 00010046 .... Call Trace: icl_update_topdown_event+0x165/0x190 ? ktime_get+0x38/0xd0 intel_pmu_read_event+0xf9/0x210 __perf_event_read+0xf9/0x210 CPUs 16-23 are E-core CPUs that don't support the perf metrics feature. The icl_update_topdown_event() should not be invoked on these CPUs. It's a regression of commit: f9bdf1f95339 ("perf/x86/intel: Avoid disable PMU if !cpuc->enabled in sample read") The bug introduced by that commit is that the is_topdown_event() function is mistakenly used to replace the is_topdown_count() call to check if the topdown functions for the perf metrics feature should be invoked. Fix it.
- Products
- Kernel
- Affected versions
- Not specified
- Fixed versions
- 6.1.149, 6.12.49, 6.15.4, 6.6.101
- CVEs
- CVE-2025-38322
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 6 Nov 2026, 00:33 UTC · Revision 1
Source evidence
perf/x86/intel: Fix crash in icl_update_topdown_event()
core-osv · Original sourcePublished 10 Jul 2025, 08:14 UTC
In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: Fix crash in icl_update_topdown_event() The perf_fuzzer found a hard-lockup crash on a RaptorLake machine: Oops: general protection fault, maybe for address 0xffff89aeceab400: 0000 CPU: 23 UID: 0 PID: 0 Comm: swapper/23 Tainted: [W]=WARN Hardware name: Dell Inc. Precision 9660/0VJ762 RIP: 0010:native_read_pmc+0x7/0x40 Code: cc e8 8d a9 01 00 48 89 03 5b cd cc cc cc cc 0f 1f ... RSP: 000:fffb03100273de8 EFLAGS: 00010046 .... Call Trace: icl_update_topdown_event+0x165/0x190 ? ktime_get+0x38/0xd0 intel_pmu_read_event+0xf9/0x210 __perf_event_read+0xf9/0x210 CPUs 16-23 are E-core CPUs that don't support the perf metrics feature. The icl_update_topdown_event() should not be invoked on these CPUs. It's a regression of commit: f9bdf1f95339 ("perf/x86/intel: Avoid disable PMU if !cpuc->enabled in sample read") The bug introduced by that commit is that the is_topdown_event() function is mistakenly used to replace the is_topdown_count() call to check if the topdown functions for the perf metrics feature should be invoked. Fix it.
osv:CVE-2025-38322
Kernel
Fixed versions: 6.1.149, 6.6.101, 6.12.49, 6.15.4
Complete source record
{
"id": "0321e180ed77f87c1d3046da39c4b802e568d0d69be1065fc2436ef05811cf57",
"url": "https://osv.dev/vulnerability/CVE-2025-38322",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "perf/x86/intel: Fix crash in icl_update_topdown_event()",
"summary": "In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: Fix crash in icl_update_topdown_event() The perf_fuzzer found a hard-lockup crash on a RaptorLake machine: Oops: general protection fault, maybe for address 0xffff89aeceab400: 0000 CPU: 23 UID: 0 PID: 0 Comm: swapper/23 Tainted: [W]=WARN Hardware name: Dell Inc. Precision 9660/0VJ762 RIP: 0010:native_read_pmc+0x7/0x40 Code: cc e8 8d a9 01 00 48 89 03 5b cd cc cc cc cc 0f 1f ... RSP: 000:fffb03100273de8 EFLAGS: 00010046 .... Call Trace: icl_update_topdown_event+0x165/0x190 ? ktime_get+0x38/0xd0 intel_pmu_read_event+0xf9/0x210 __perf_event_read+0xf9/0x210 CPUs 16-23 are E-core CPUs that don't support the perf metrics feature. The icl_update_topdown_event() should not be invoked on these CPUs. It's a regression of commit: f9bdf1f95339 (\"perf/x86/intel: Avoid disable PMU if !cpuc->enabled in sample read\") The bug introduced by that commit is that the is_topdown_event() function is mistakenly used to replace the is_topdown_count() call to check if the topdown functions for the perf metrics feature should be invoked. Fix it.",
"evidence": "osv:CVE-2025-38322",
"products": [
{
"name": {
"value": "Kernel",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "6.1.149",
"evidence": "/affected/1/ranges"
},
{
"value": "6.6.101",
"evidence": "/affected/1/ranges"
},
{
"value": "6.12.49",
"evidence": "/affected/1/ranges"
},
{
"value": "6.15.4",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "CVE-2025-38322",
"aliases": [
"CVE-2025-38322"
],
"affected": [
{
"ranges": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "781b2db0eb7731fbde510c268b7ccc62959c3feb"
},
{
"fixed": "702ea6028032d6c1fe96c2d4762a3575e3654819"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "e7f6922c8a5b41522a8329ea6bbf815993b2dd28"
},
{
"fixed": "79e2dd573116d3338507c311460da9669095c94d"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "3a8bec6583e5239de3bd597ab382dc6c2b0c29a1"
},
{
"fixed": "e97c45c770f5e56c784a46c2a96ab968d26b97d9"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "f9bdf1f953392c9edd69a7f884f78c0390127029"
},
{
"fixed": "a85cc69acdcb05f8cd226b8ea0778b8e2e887e6f"
},
{
"fixed": "b0823d5fbacb1c551d793cbfe7af24e0d1fa45ed"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "6.1.134"
},
{
"fixed": "6.1.149"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "6.6.87"
},
{
"fixed": "6.6.101"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "6.12.23"
},
{
"fixed": "6.12.49"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "6.13.11"
},
{
"fixed": "6.14"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "6.14.2"
},
{
"fixed": "6.15"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "06cd7bfbb86e9db3e9013ea6636ad2c6f0a1664d"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "d8370aa704bd7e384918c8f466856374725c0585"
}
]
}
],
"versions": [
"v6.1.148",
"v6.1.147",
"v6.1.146",
"v6.1.145",
"v6.1.144",
"v6.1.143",
"v6.1.142",
"v6.1.141",
"v6.1.140",
"v6.1.139",
"v6.1.138",
"v6.1.137",
"v6.1.136",
"v6.1.135",
"v6.1.134",
"v6.6.100",
"v6.6.99",
"v6.6.98",
"v6.6.97",
"v6.6.96",
"v6.6.95",
"v6.6.94",
"v6.6.93",
"v6.6.92",
"v6.6.91",
"v6.6.90",
"v6.6.89",
"v6.6.88",
"v6.6.87",
"v6.12.48",
"v6.12.47",
"v6.12.46",
"v6.12.45",
"v6.12.44",
"v6.12.43",
"v6.12.42",
"v6.12.41",
"v6.12.40",
"v6.12.39",
"v6.12.38",
"v6.12.37",
"v6.12.36",
"v6.12.35",
"v6.12.34",
"v6.12.33",
"v6.12.32",
"v6.12.31",
"v6.12.30",
"v6.12.29",
"v6.12.28",
"v6.12.27",
"v6.12.26",
"v6.12.25",
"v6.12.24",
"v6.12.23",
"v6.13.12",
"v6.13.11",
"v6.14.11",
"v6.14.10",
"v6.14.9",
"v6.14.8",
"v6.14.7",
"v6.14.6",
"v6.14.5",
"v6.14.4",
"v6.14.3",
"v6.14.2"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-38322.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "6.1.149"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.2.0"
},
{
"fixed": "6.6.101"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.7.0"
},
{
"fixed": "6.12.49"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.13.0"
},
{
"fixed": "6.15.4"
}
]
}
],
"package": {
"name": "Kernel",
"ecosystem": "Linux"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-38322.json"
}
}
],
"modified": "2026-10-28T02:30:45.603123686Z",
"provider": "osv",
"references": [
"https://cert-portal.siemens.com/productcert/html/ssa-019113.html",
"https://cert-portal.siemens.com/productcert/html/ssa-032379.html",
"https://cert-portal.siemens.com/productcert/html/ssa-457936.html",
"https://git.kernel.org/stable/c/702ea6028032d6c1fe96c2d4762a3575e3654819",
"https://git.kernel.org/stable/c/79e2dd573116d3338507c311460da9669095c94d",
"https://git.kernel.org/stable/c/a85cc69acdcb05f8cd226b8ea0778b8e2e887e6f",
"https://git.kernel.org/stable/c/b0823d5fbacb1c551d793cbfe7af24e0d1fa45ed",
"https://git.kernel.org/stable/c/e97c45c770f5e56c784a46c2a96ab968d26b97d9",
"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38322.json",
"https://nvd.nist.gov/vuln/detail/CVE-2025-38322",
"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
],
"provider_metadata": {
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38322.json"
}
},
"related_cves": [
{
"value": "CVE-2025-38322",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 513516,
"published_at": "2025-07-10T08:14:57.603+00:00"
}