CVE-2025-40042

A race condition flaw was found in the Linux kernel's tracing subsystem during kprobe initialization. The race occurs between kprobe activation and perf_events initialization on different CPUs. When CPU0 enables kprobe functionality via class->reg() but before perf_events is fully assigned, CPU1 can trigger the kprobe and attempt to access the perf_events pointer while it is still NULL. This results in a NULL pointer dereference in kprobe_perf_func(), causing a kernel crash. A local user with the ability to use tracing/kprobe functionality could exploit this to cause a denial of service.

This vulnerability requires local access and the ability to use kernel tracing features (kprobes/perf). The race window is narrow but reproducible under specific conditions. Exploitation results in a kernel crash requiring a system reboot.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.