CVE-2025-40327

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix system hang caused by cpu-clock usage cpu-clock usage by the async-profiler tool can trigger a system hang, which got bisected back to the following commit by Octavia Togami: 18dbcbfabfff ("perf: Fix the POLL_HUP delivery breakage") causes this issue The root cause of the hang is that cpu-clock is a special type of SW event which relies on hrtimers. The __perf_event_overflow() callback is invoked from the hrtimer handler for cpu-clock events, and __perf_event_overflow() tries to call cpu_clock_event_stop() to stop the event, which calls htimer_cancel() to cancel the hrtimer. But that's a recursion into the hrtimer code from a hrtimer handler, which (unsurprisingly) deadlocks. To fix this bug, use hrtimer_try_to_cancel() instead, and set the PERF_HES_STOPPED flag, which causes perf_swevent_hrtimer() to stop the event once it sees the PERF_HES_STOPPED flag. [ mingo: Fixed the comments and improved the changelog. ]

Package Linux Kernel
Published 2025-12-09
Last modified 2026-04-15
Patch available
Yes

Affected versions

Linux kernel versions 6.16.8, 6.17 and later are affected. Fixed in 6.17.8, 6.18 and their respective stable series.

Affected from
≥ 6.16.8 ≥ 6.17
Fixed in
✓ 6.17.8 6.17.x ✓ 6.18

References

The following references provide additional information about CVE-2025-40327 including vendor advisories, patch commits, exploit details, and third-party analysis. Links are sourced from the NIST NVD database.

Frequently asked questions

  • What is CVE-2025-40327?

    CVE-2025-40327 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 6.16.8 onward and has been patched in 6.17.8 and 6.18. CVE-2025-40327 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

  • Is there a patch available for CVE-2025-40327?

    Yes — CVE-2025-40327 has been patched. Fixed versions include 6.17.8 and 6.18. If you are running Linux kernel 6.16.8 or later up to the fix versions, apply the relevant patch for your kernel branch.

  • Is CVE-2025-40327 actively exploited?

    No — CVE-2025-40327 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.