CVE-2025-38168

A flaw was found in the Linux kernel's arm-ni performance monitoring unit (PMU) driver. When a resource allocation fails during device probing, the system does not properly unregister previously registered PMUs. This oversight allows a local attacker with low privileges to trigger a kernel panic, leading to a denial of service (DoS) condition.

A low impact denial of service flaw was found in the Linux kernel's Arm NI-700 interconnect PMU (arm-ni) driver, affecting Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, and Red Hat In-Vehicle OS. When a resource allocation fails in one clock domain of an NI device during driver probing, the driver does not roll back perf PMUs it already registered in other clock domains of the same device; these stale registrations cause list corruption and a kernel panic on subsequent PMU registration, so a local attacker able to trigger the probe failure on Arm NI-700 interconnect PMU hardware can crash the system. Red Hat Enterprise Linux 6, 7, and 8 are not affected because the vulnerable arm-ni driver code is not present in those releases. The fix for the affected streams is currently deferred due to the low impact of the issue; the residual risk is limited to local denial of service (kernel panic) on systems with Arm NI-700 interconnect PMU hardware. Red Hat's severity of LOW (CVSS 4.4, AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) differs from the NIST score of 5.5 MODERATE and the CVE.org score of 7.8 IMPORTANT: the flaw only impacts availability, triggering it requires privileged local access, and the confidentiality and integrity impacts reflected in the CVE.org score are not supported by the technical evidence.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.