CVE-2025-37893Off-by-one Error in Linux

CWE-193Off-by-one Error6 documents6 sources
Severity
5.5MEDIUMNVD
EPSS
0.1%
top 80.60%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedApr 18

Description

In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Fix off-by-one error in build_prologue() Vincent reported that running BPF progs with tailcalls on LoongArch causes kernel hard lockup. Debugging the issues shows that the JITed image missing a jirl instruction at the end of the epilogue. There are two passes in JIT compiling, the first pass set the flags and the second pass generates JIT code based on those flags. With BPF progs mixing bpf2bpf and tailcalls,

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages6 packages

NVDlinux/linux_kernel6.16.1.134+4
Debianlinux/linux_kernel< 6.12.25-1+1
CVEListV5linux/linux5dc615520c4dfb358245680f1904bad61116648eb3ffad2f02db4aace6799fe0049508b8925eae45+5

Patches

🔴Vulnerability Details

2
OSV
CVE-2025-37893: In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Fix off-by-one error in build_prologue() Vincent reported that run2025-04-18
GHSA
GHSA-3xjw-75cj-9fvw: In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Fix off-by-one error in build_prologue() Vincent reported that r2025-04-18

📋Vendor Advisories

3
Red Hat
kernel: LoongArch: BPF: Fix off-by-one error in build_prologue()2025-04-18
Microsoft
LoongArch: BPF: Fix off-by-one error in build_prologue()2025-04-08
Debian
CVE-2025-37893: linux - In the Linux kernel, the following vulnerability has been resolved: LoongArch: ...2025