{"id":"DEBIAN-CVE-2025-21895","details":"In the Linux kernel, the following vulnerability has been resolved:  perf/core: Order the PMU list to fix warning about unordered pmu_ctx_list  Syskaller triggers a warning due to prev_epc-\u003epmu != next_epc-\u003epmu in perf_event_swap_task_ctx_data(). vmcore shows that two lists have the same perf_event_pmu_context, but not in the same order.  The problem is that the order of pmu_ctx_list for the parent is impacted by the time when an event/PMU is added. While the order for a child is impacted by the event order in the pinned_groups and flexible_groups. So the order of pmu_ctx_list in the parent and child may be different.  To fix this problem, insert the perf_event_pmu_context to its proper place after iteration of the pmu_ctx_list.  The follow testcase can trigger above warning:   # perf record -e cycles --call-graph lbr -- taskset -c 3 ./a.out &  # perf stat -e cpu-clock,cs -p xxx // xxx is the pid of a.out   test.c   void main() {         int count = 0;         pid_t pid;          printf(\"%d running\\n\", getpid());         sleep(30);         printf(\"running\\n\");          pid = fork();         if (pid == -1) {                 printf(\"fork error\\n\");                 return;         }         if (pid == 0) {                 while (1) {                         count++;                 }         } else {                 while (1) {                         count++;                 }         }  }  The testcase first opens an LBR event, so it will allocate task_ctx_data, and then open tracepoint and software events, so the parent context will have 3 different perf_event_pmu_contexts. On inheritance, child ctx will insert the perf_event_pmu_context in another order and the warning will trigger.  [ mingo: Tidied up the changelog. ]","modified":"2026-08-27T23:05:27.132182338Z","published":"2025-04-01T16:15:19.883Z","upstream":["CVE-2025-21895"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2025-21895"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.19-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-21895.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.19-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-21895.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}