CVE-2025-40327: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-40327 is a Linux kernel vulnerability in the perf/core subsystem that causes a system hang (deadlock) when cpu-clock software events are used, particularly by profiling tools such as async-profiler. The issue was introduced by commit 18dbcbfabfff ("perf: Fix the POLL_HUP delivery breakage") and affects Linux kernel versions from that commit up to (but not including) the fixed commits 6b8c512811644cf2f5eaf6f44e928683c54127f0 and eb3182ef0405ff2f6668fd3e5ff9883f60ce8801. It was published on December 9, 2025. The CVSS score has not been formally assigned; Feedly estimates the severity as Medium, and the ENISA EUVD lists a base score of 0.0 pending official scoring (Feedly, ENISA EUVD).

The root cause is a recursive deadlock (CWE-833: Deadlock) in the Linux kernel's performance event subsystem. cpu-clock is a software event type that relies on high-resolution timers (hrtimers). When __perf_event_overflow() is invoked from within an hrtimer handler for a cpu-clock event, it attempts to stop the event by calling cpu_clock_event_stop(), which in turn calls hrtimer_cancel() to cancel the active hrtimer. Calling hrtimer_cancel() from within an hrtimer handler causes a recursive lock acquisition, resulting in a deadlock and system hang. The fix replaces hrtimer_cancel() with hrtimer_try_to_cancel() and sets the PERF_HES_STOPPED flag so that perf_swevent_hrtimer() can cleanly stop the event upon detecting the flag (Feedly, ENISA EUVD).

Successful triggering of this vulnerability causes a complete system hang (deadlock), resulting in a total loss of availability for the affected Linux host. Any local user or process with permission to use perf cpu-clock events — including profiling tools like async-profiler — can inadvertently or deliberately trigger the hang. There is no known confidentiality or integrity impact; the primary consequence is a denial of service requiring a hard reboot to recover (Feedly, ENISA EUVD).

The fix is included in Linux kernel stable commits 6b8c512811644cf2f5eaf6f44e928683c54127f0 (for one stable branch) and eb3182ef0405ff2f6668fd3e5ff9883f60ce8801 (for another), as well as in kernel version 6.17.8 and the 6.18 release. Administrators should update to a patched kernel version as soon as it is available from their Linux distribution. As a temporary workaround, restricting unprivileged access to perf events (e.g., via kernel.perf_event_paranoid sysctl) or disabling use of cpu-clock profiling tools like async-profiler can reduce exposure until a patch is applied (Feedly, ENISA EUVD).