CVE-2025-40081

In the Linux kernel, the following vulnerability has been resolved:

perf: arm_spe: Prevent overflow in PERF_IDX2OFF()

Cast nr_pages to unsigned long to avoid overflow when handling large AUX buffer sizes (>= 2 GiB).

The patch fixes an integer overflow in the PERF_IDX2OFF() macro used by ARM SPE perf events. When nr_pages exceeded 2 GiB worth of buffer pages, (buf->nr_pages << PAGE_SHIFT) could overflow due to nr_pages being int. This caused incorrect buffer offsets or wraparounds during AUX trace handling, potentially corrupting trace data or causing a kernel crash. Exploitation requires local privileged access to configure large perf AUX buffers.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.