Linux kernel arm_spe: integer overflow in PERF_IDX2OFF with AUX buffers of 2 GiB or more

Impact

PERF_IDX2OFF() computed an offset without casting nr_pages to unsigned long, so an Arm Statistical Profiling Extension session with an AUX ring buffer of 2 GiB or larger overflows the calculation and the driver writes profile records at a wrong offset. This matters only on Arm64 hosts with SPE present and enabled, which in a GPU fleet means Grace and other Arm-based head and compute nodes used for profiling. Consequence is memory corruption inside the perf AUX path and a likely host crash rather than a tenant-visible escape; the record gives no evidence of a cross-tenant path. Treat it as a stability and hardening fix for nodes where profiling is actually run.

Who can reach it

Local only, and only on Arm64 hardware exposing SPE. Requires the ability to open a perf AUX session with a very large buffer, which under the default perf_event_paranoid setting means a privileged user. Unreachable on x86 nodes and on Arm nodes where SPE is not enabled.

What to do

Pick up the stable kernel commits listed in the record (the nr_pages cast). No configuration mitigation is described upstream; declining to allocate multi-gigabyte AUX buffers avoids the condition in practice. The fix ships as a kernel update, so Arm64 nodes need a drain and reboot - low urgency, fold it into the next kernel cycle.

References

Related entries

• Linux kernel (drivers/gpu/drm/scheduler): When adding reservation-object dependencies to a job, the helper alreadyCVE-2025-40096 · Linux kernel (drivers/gpu/drm/scheduler)High
• Linux kernel (drivers/gpu/drm/vmwgfx): A guest process can get a node left in the vmwgfx validation hash table afterCVE-2025-40111 · Linux kernel (drivers/gpu/drm/vmwgfx)High
• Linux kernel pm80xx: out-of-bounds phy array index when unloading the driver behind a SAS expanderCVE-2025-40118 · Linux kernel scsi pm80xx (phy array index on device teardown)High
• Linux kernel BPF: tailcalls ignore expected_attach_type, yielding NULL deref and bypassed context checksCVE-2025-40123 · Linux kernel BPF tailcall map compatibility (__bpf_prog_map_compatible)High
• Linux kernel SMC: dst entry can be freed under smc_clc_prfx_set during connect(), a local UAFCVE-2025-40139 · Linux kernel SMC protocol (smc_clc_prfx_set destination cache use-after-free)High
• Linux kernel (net/tls): The kTLS device-offload setup resolved the socket's netdevice outside RCU, so the net_device itCVE-2025-40149 · Linux kernel (net/tls)High