Linux Kernel Perf Event Hang Vulnerability in Debian Packages
Summary
CVE-2025-37747: In the Linux kernel, the following vulnerability has been resolved: perf: Fix hang while freeing sigtrap event Perf can hang while freeing a sigtrap event if a related deferred signal hadn't managed to be sent before the... Affects linux versions 6.1.106-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing system resources and hardware communication. It provides essential services for all other parts of the operating system, including process management, memory management, and device drivers. This vulnerability affects the 'perf' subsystem, which is used for performance monitoring and profiling. The issue arises when freeing a sigtrap event, potentially leading to system hangs under specific conditions.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified within the 'perf' subsystem that can cause the system to hang while freeing a sigtrap event. This occurs if a related deferred signal has not been sent before the file is closed, leading to a failure in task work cancellation. The hang is triggered during the execution of task_work_run(), where the list of pending callbacks is removed from the task_struct, preventing any further cancellation of pending work items. This situation can lead to significant performance issues and system instability, particularly in environments that rely on performance monitoring.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it becomes available to mitigate the risk of system hangs.
Conclusion
The Linux kernel vulnerability identified as CVE-2025-37747 poses a significant risk of system hangs due to issues in the perf subsystem. Users are strongly advised to update their kernel packages to the latest versions to mitigate this risk. Utilizing tools like Vulert can further enhance security by providing real-time monitoring for vulnerabilities.
See every vulnerability recorded for linux →
FAQ
The vulnerability causes the Linux kernel's perf subsystem to hang while freeing a sigtrap event, which can lead to system instability.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities. By uploading your manifest file, you can check if your application is affected by this vulnerability.
The vulnerability can lead to performance degradation and system hangs, particularly in environments that utilize performance monitoring tools.
Yes, a patch has been released for the affected Linux kernel versions. Users should update their packages to the latest versions to apply the fix.
Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities in your software, allowing for proactive management of security risks.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
