Race Condition Vulnerability in Linux Kernel Coresight Configuration
Summary
CVE-2025-38132: In the Linux kernel, the following vulnerability has been resolved: coresight: holding cscfg_csdev_lock while removing cscfg from csdev There'll be possible race scenario for coresight config: CPU0 CPU1 (perf enable) loa... Affects linux versions 6.1.106-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, managing hardware and system resources. It provides essential services for all other parts of the system, ensuring efficient operation and resource management. The Coresight framework within the Linux kernel is designed for tracing and debugging, allowing developers to monitor system performance and diagnose issues. However, a race condition vulnerability has been identified in the Coresight configuration, which could lead to instability and security risks.
Vulnerability Detail
In the Linux kernel, a race condition exists in the Coresight configuration management. This occurs when two CPUs attempt to modify the configuration simultaneously, leading to potential inconsistencies. Specifically, while one CPU is activating a configuration, another CPU may attempt to remove it, causing a race condition that can lead to system instability or crashes. The vulnerability arises from improper locking mechanisms, allowing concurrent access to shared resources without adequate synchronization.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid activating and removing configurations simultaneously. Implementing proper locking mechanisms in custom configurations can also help prevent race conditions until an official patch is applied.
Conclusion
The race condition vulnerability in the Linux kernel's Coresight configuration poses significant risks to system stability and security. It is crucial for users to update their systems to the latest patched versions to mitigate these risks. Temporary workarounds can help, but applying the official fix is the best course of action.
See every vulnerability recorded for linux →
FAQ
A race condition occurs when two or more processes access shared resources concurrently, and the final outcome depends on the timing of their execution.
This vulnerability can lead to system instability, crashes, or unexpected behavior, particularly when the Coresight configuration is actively being modified.
You can check if your application is affected by this vulnerability using Vulert's playground at Vulert Scanner, which analyzes your manifest file for vulnerabilities.
If immediate updates are not possible, avoid simultaneous configuration changes and consider implementing custom locking mechanisms as a temporary measure.
Detailed information about this vulnerability can be found in the CVE database and through security advisories related to the Linux kernel.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
