Linux kernel perf: throttling a group with disabled members calls PMU start/stop with hw.idx == -1

Impact

When a perf event group is throttled, perf_event_throttle_group() walked every sibling including ones left in PERF_EVENT_STATE_OFF, whose hw.idx is still -1 because they were never scheduled onto the PMU. The driver then uses that negative index as a shift exponent when writing PMU enable registers, which is undefined behaviour and reported by UBSAN as shift-out-of-bounds; reproduced by syzkaller on both arm64 and x86-64. The consequence is a write derived from an out-of-range counter index into hardware PMU control registers from an unprivileged-reachable path, plus log spam on any kernel built with UBSAN. This matters on GPU nodes because profiling is routinely enabled for tenants - perf_event_paranoid is commonly loosened so users can profile their own training jobs - and a crafted event group is then something a tenant can construct. The record documents undefined behaviour and the UBSAN report, not a demonstrated privilege escalation.

Who can reach it

Local user able to call perf_event_open and create an event group with an aggressive sample period plus a disabled child event. No root needed where kernel.perf_event_paranoid permits unprivileged or per-task profiling; on a host left at the restrictive default the path needs CAP_PERFMON. Reachable from inside a container if the perf syscall is not blocked by seccomp.

What to do

Apply the stable kernel commits in the record, which move the state check into perf_event_throttle()/perf_event_unthrottle() so inactive events are skipped. That is a kernel update: drain the node and reboot it. Until then, raising kernel.perf_event_paranoid back to 2 (or 3 where supported) and blocking perf_event_open in the container seccomp profile removes tenant reach, at the cost of taking profiling away from your users. No fixed release version is stated in the record beyond the listed commits.

References

Related entries

• Linux kernel lpfc: use-after-free in the deferred receive path on Emulex Fibre Channel HBAsCVE-2025-39841 · Linux kernel lpfc driver (Emulex/Broadcom Fibre Channel HBA, deferred receive path)High
• Linux kernel ice: NULL dereference in the E810 low-latency PTP timestamp interrupt during resetCVE-2025-39854 · Linux kernel ice driver (Intel E810 PTP low-latency Tx timestamp interrupt)High
• Linux kernel ice: NULL dereference in the E810 PTP Tx timestamp IRQ racing driver resetCVE-2025-39855 · Linux kernel ice driver (Intel E810 PTP Tx timestamp IRQ, ice_ptp_ts_irq)High
• Linux kernel idxd: double free in idxd_setup_wqs() error path during DSA device probeCVE-2025-39870 · Linux kernel idxd driver (Intel Data Streaming Accelerator / DSA work-queue setup)High
• Linux kernel idxd: refcount underflow and use-after-free when unloading the Intel DSA driverCVE-2025-39871 · Linux kernel idxd driver (Intel DSA, device refcount on module removal)High
• Linux kernel DAMON sysfs: use-after-free reading kdamond state while a context is torn downCVE-2025-39877 · Linux kernel DAMON sysfs interface (state_show, /sys/kernel/mm/damon)High