CVE-2025-40359: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-40359 is a KASAN global-out-of-bounds memory access vulnerability in the Linux kernel's perf/x86/intel subsystem. It was published on December 16, 2025, and affects Linux kernel versions starting from commit 090262439f66df03d4e9d0e52e14104b729e2ef8 up to the patched releases in the 6.12, 6.17, and 6.18 stable branches. The flaw is triggered when running perf mem record on non-hybrid Intel platforms (such as CWF/Clearwater Forest), causing an out-of-bounds read in cmt_latency_data. No CVSS base score has been assigned at this time (Feedly, EUVD).

The root cause is an improper bounds check (CWE-125: Out-of-bounds Read) in the __grt_latency_data() function within the Linux kernel's Intel PMU (Performance Monitoring Unit) driver. Specifically, the code unconditionally calls hybrid_pmu(event->pmu)->pmu_type == hybrid_big via a WARN_ON_ONCE macro, which attempts to dereference the x86_hybrid_pmu structure. On non-hybrid platforms like CWF, this structure does not exist, resulting in a global-out-of-bounds memory read at a fixed kernel address (ffffffffb721d000). The fix adds an is_hybrid() guard check before the WARN_ON_ONCE call to prevent the invalid dereference. The call trace involves cmt_latency_data → setup_arch_pebs_sample_data → intel_pmu_drain_arch_pebs → handle_pmi_common (Feedly).

Exploitation of this vulnerability causes an out-of-bounds read in kernel memory, which can lead to kernel instability or crashes (denial of service) on affected non-hybrid Intel platforms. Because the read occurs in a kernel context during performance monitoring event handling, it may also expose sensitive kernel memory contents, posing a limited information disclosure risk. The vulnerability is locally triggered and does not directly enable remote code execution or privilege escalation based on available information (Feedly, EUVD).

The Linux kernel maintainers have released patches addressing this vulnerability in the following stable branches: 6.12.58, 6.17.8, and 6.18. The fix is available via the following upstream commits: 1b61a1da3d8105ea1be548c94c2856697eb7ffd1, 710a72e81a7028e1ad1a10eb14f941f8dd45ffd3, and 0ba6502ce167fc3d598c08c2cc3b4ed7ca5aa251. Users should update to a patched kernel version as soon as possible. As a temporary workaround, restricting access to the perf subsystem (e.g., via kernel.perf_event_paranoid sysctl) on affected non-hybrid Intel systems can reduce exposure (Feedly, EUVD).