CVE-2025-37884 Details
Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix deadlock between rcu_tasks_trace and event_mutex. Fix the following deadlock: CPU A _free_event() perf_kprobe_destroy() mutex_lock(&event_mutex) perf_trace_event_unreg() synchronize_rcu_tasks_trace() There are several paths where _free_event() grabs event_mutex and calls sync_rcu_tasks_trace. Above is one such case. CPU B bpf_prog_test_run_syscall() rcu_read_lock_trace() bpf_prog_run_pin_on_cpu() bpf_prog_load() bpf_tracing_func_proto() trace_set_clr_event() mutex_lock(&event_mutex) Delegate trace_set_clr_event() to workqueue to avoid such lock dependency.
A deadlock vulnerability has been identified in the Linux kernel's BPF (Berkeley Packet Filter) event handling, specifically between the RCU (Read-Copy-Update) task tracing and the event mutex. This deadlock occurs when the CPU A frees an event, which involves destroying a performance kprobe. During this process, it locks the event mutex and unregisters the performance trace event, leading to a deadlock situation. Additionally, the BPF program test run syscall can also create a similar deadlock by pinning a BPF program on a CPU, loading it, and then attempting to trace an event while holding the event mutex.
The vulnerability has been addressed by delegating the event tracing management to a workqueue, thereby avoiding the circular lock dependency. Users should ensure they are running a version of the Linux kernel that includes this fix.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/45286680b385f2592db3003554872388dee66d68 | kernel.org | Patch |
| https://git.kernel.org/stable/c/4580f4e0ebdf8dc8d506ae926b88510395a0c1d1 | kernel.org | Patch |
| https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html | CVE | Mailing ListThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-667 | Improper Locking | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | < 6.1.136 >= 6.2, < 6.6.89 >= 6.7, < 6.12.26 >= 6.13, < 6.14.5 |
CPE
Remediation
| |
| debian debian linux | 11.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| Jan 2, 2026 | CVE Modified | kernel.org |
| Nov 12, 2025 | Initial Analysis | [email protected] |
| Nov 3, 2025 | CVE Modified | CVE |
| May 9, 2025 | New CVE Received | kernel.org |