Linux Kernel CVE-2025-40081

Upstream fix available (commit/stable backports); the change casts nr_pages to unsigned long in PERF_IDX2OFF(). Apply the vendor kernel update that incorporates these stable commits (see the git.kernel.org/stable references such as https://git.kernel.org/stable/c/379cae2cb982f571cda9493ac573ab71125fd299 and https://git.kernel.org/stable/c/e516cfd19b0f4c774a57b17fb43a7f41991f0735), or upgrade to your distribution's patched kernel package once released. As a compensating control until patched, restrict access to perf/SPE events by setting kernel.perf_event_paranoid to 2 or higher (or 3/4 where supported) to prevent unprivileged users from opening hardware trace events, and/or require CAP_PERFMON so only trusted accounts can profile - the trade-off is that legitimate performance-profiling and observability tooling on affected arm64 hosts will lose access. Because the trigger requires an AUX buffer >= 2 GiB, tightening RLIMIT/locked-memory limits for untrusted users also raises the bar, at the cost of constraining other memory-intensive workloads.