CVE-2025-37884
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
09/05/2025
Last modified:
02/01/2026
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
bpf: Fix deadlock between rcu_tasks_trace and event_mutex.<br />
<br />
Fix the following deadlock:<br />
CPU A<br />
_free_event()<br />
perf_kprobe_destroy()<br />
mutex_lock(&event_mutex)<br />
perf_trace_event_unreg()<br />
synchronize_rcu_tasks_trace()<br />
<br />
There are several paths where _free_event() grabs event_mutex<br />
and calls sync_rcu_tasks_trace. Above is one such case.<br />
<br />
CPU B<br />
bpf_prog_test_run_syscall()<br />
rcu_read_lock_trace()<br />
bpf_prog_run_pin_on_cpu()<br />
bpf_prog_load()<br />
bpf_tracing_func_proto()<br />
trace_set_clr_event()<br />
mutex_lock(&event_mutex)<br />
<br />
Delegate trace_set_clr_event() to workqueue to avoid<br />
such lock dependency.
Impact
Base Score 3.x
5.50
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.1.136 (excluding) | |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.2 (including) | 6.6.89 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.7 (including) | 6.12.26 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.13 (including) | 6.14.5 (excluding) |
| cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page



