Kernel Vulnerability in Linux Package: Unordered PMU Contexts Leading to Warnings
Summary
DEBIAN-CVE-2025-21895: In the Linux kernel, the following vulnerability has been resolved: perf/core: Order the PMU list to fix warning about unordered pmu_ctx_list Syskaller triggers a warning due to prev_epc->pmu != next_epc->pmu in perf_eve... Affects linux versions < 6.12.19-1. Fixed in 6.12.19-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of the Debian operating system, responsible for managing hardware resources and providing essential services to applications. It supports a wide range of functionalities, including process management, memory management, and device control. The vulnerability in question arises from an issue with the performance monitoring unit (PMU) context ordering, which can lead to warnings during performance analysis tasks.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified related to the ordering of the PMU context list. This issue can trigger warnings in the Syskaller tool due to discrepancies in the order of pmu_ctx_list between parent and child processes. Specifically, when events or PMUs are added, the order of contexts can differ, leading to potential mismanagement of performance monitoring tasks. The vulnerability can be exploited during performance recording, causing confusion in the context management and potentially impacting system performance.
How To Fix
Minimum fixed version
6.12.19-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can avoid triggering the warning by ensuring that performance monitoring events are managed carefully, particularly when forking processes. However, the best course of action is to apply the patch as soon as it is available.
Conclusion
The vulnerability in the Linux kernel regarding unordered PMU contexts poses a risk during performance monitoring tasks. It is crucial to update to the patched version 6.12.19-1 to mitigate this issue. Users are encouraged to monitor their systems for vulnerabilities using tools like Vulert to ensure ongoing security.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to warnings during performance monitoring tasks, which may affect the accuracy of performance data collected by tools like Syskaller.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By uploading your manifest file, you can check if your application is affected by this vulnerability.
If an immediate update is not possible, consider implementing workarounds by managing performance monitoring events carefully to avoid triggering the warnings.
Yes, the vulnerability is fixed in version 6.12.19-1 of the Linux package.
Detailed information about the vulnerability can be found in the Debian CVE database and other security advisories related to the Linux kernel.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
