#VU106120 Improper locking in Linux kernel - CVE-2025-21889

Vulnerability identifier: #VU106120

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-21889

CWE-ID: CWE-667

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the perf_event_exec() function in kernel/events/core.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/0fe8813baf4b2e865d3b2c735ce1a15b86002c74
https://git.kernel.org/stable/c/a2475ccad6120546ea45dbcd6cd1f74dc565ef6b
https://git.kernel.org/stable/c/dd536566dda9a551fc2a2acfab5313a5bb13ed02
https://git.kernel.org/stable/c/f390c2eea571945f357a2d3b9fcb1c015767132e

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.