KVM PEBS_ENABLE Misconfiguration Vulnerability in Linux Kernel
Summary
CVE-2025-37936: In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for guest with vCPU's value. Affects linux versions < 6.1.140-1. Fixed in 6.1.140-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing system resources and facilitating communication between hardware and software. It provides essential functionalities such as process management, memory management, and device drivers. This vulnerability specifically affects the kernel's handling of Performance Monitoring Unit (PMU) events in KVM (Kernel-based Virtual Machine) environments, where guest virtual machines may inadvertently enable Performance Event Based Sampling (PEBS) even when not desired.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the way the MSR_IA32_PEBS_ENABLE value is generated for KVM guests. The issue arises when the kernel masks the PEBS_ENABLE value with the host's configuration instead of the guest's desired settings. This misconfiguration can lead to the guest operating with PEBS enabled, resulting in unexpected behavior such as crashes due to excessive page faults. Specifically, if the guest has not set the MSR_IA32_DS_AREA, it may encounter page faults on address '0' when attempting to record PEBS events. This vulnerability can be exploited by running specific profiling commands that create guest-only PEBS events, which the kernel misinterprets, leading to instability.
How To Fix
Minimum fixed version
6.1.140-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid running profiling commands that create guest-only PEBS events until the kernel is updated. This can help mitigate the risk of crashes associated with the vulnerability.
Conclusion
The vulnerability CVE-2025-37936 in the Linux kernel poses significant risks to KVM guests by enabling PEBS without the guest's consent, leading to potential crashes. Users are advised to update their kernel to the latest version to mitigate this risk and can utilize Vulert for real-time monitoring of vulnerabilities in their software.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to crashes in KVM guests due to unexpected page faults when PEBS is enabled without the guest's consent.
You can use Vulert, which monitors open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected by this vulnerability without any signup.
Performance Event Based Sampling (PEBS) is a feature that allows for efficient sampling of performance events in a system, helping developers and system administrators analyze performance issues.
Yes, the permanent fix is to update the Linux kernel to a version that includes the patch for this vulnerability.
If an immediate update is not possible, avoid using profiling commands that may trigger the vulnerability as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
