CVE-2025-38322 Siemens CVE debrief

Who should care

Linux kernel maintainers, distro and appliance vendors, and operators of Intel Raptor Lake systems that expose perf/perf_event functionality should review this issue. It is most relevant where local users or diagnostics can trigger perf reads on affected kernels, especially on systems using E-core CPUs.

Technical summary

The advisory text says perf_fuzzer found a hard-lockup crash on a Raptor Lake machine, with a call trace reaching icl_update_topdown_event() and native_read_pmc(). The root cause is described as a regression from commit f9bdf1f95339, where is_topdown_event() was used in place of is_topdown_count() to decide whether the perf metrics topdown path should run. On CPUs 16-23 in the reported system, the E-core CPUs do not support perf metrics, so invoking that path there can cause a general protection fault or crash.

Defensive priority

Medium. The CVSS score in the supplied source is 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), which indicates a local, availability-focused issue. Prioritize remediation on affected Intel Raptor Lake deployments and any Linux build that includes the vulnerable perf/x86/intel logic.

Recommended defensive actions

• Apply the vendor-provided fix or update to a kernel/software build that contains the icl_update_topdown_event() correction.
• Verify whether your deployed kernel includes the regression associated with commit f9bdf1f95339 and update if it does.
• Review local access to performance-monitoring interfaces and limit use to trusted administrators where operationally feasible.
• Monitor affected systems for kernel oops, hard-lockup, or unexpected perf-related crashes, especially on Raptor Lake E-core systems.
• Validate product attribution against the vendor advisory before relying on the supplied Siemens product metadata, as the advisory body describes a Linux kernel issue.

Evidence notes

The supplied CISA CSAF source (ICSA-26-134-10 / CVE-2025-38322) describes a Linux kernel perf/x86/intel crash, not an exploitation chain or weaponized payload. It explicitly states that E-core CPUs in the reported Raptor Lake system do not support perf metrics and that icl_update_topdown_event() should not run there. The same source identifies the regression source as commit f9bdf1f95339 and the logic error as substituting is_topdown_event() for is_topdown_count(). The source metadata also names Siemens SIMATIC CN 4100 vers:intdot/<5.0, which does not match the Linux kernel description and should be treated as needing manual review.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.