CVE-2025-22048

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

Exploitation requires loading a JITed eBPF program containing a bpf2bpf subprog call via the bpf() syscall on the local system. Per kernel scoring guidance, BPF is a Local attack vector.

AC:LAttack complexity, low

The miscompilation is deterministic — every bpf2bpf call site in a JITed program on LoongArch unconditionally clobbers R0 with the sign-extended low 32 bits, with no race, timing, or memory-layout precondition for the corruption itself. The attacker fully controls the program text, the returned pointer type, and the dereference offset.

PR:LPrivileges required, low

Loading a subprog-containing SOCKET_FILTER/CGROUP_SKB program needs no capability at all when kernel.unprivileged_bpf_disabled=0, a supported and widely-deployed setting (and the default when CONFIG_BPF_UNPRIV_DEFAULT_OFF=n, common on vendor/embedded LoongArch kernels). Otherwise only CAP_BPF is required, which is by design not root-equivalent and is exactly the low-privilege principal the verifier is supposed to contain.

UI:NUser interaction, none

The attacker loads the program and triggers it entirely on their own — e.g. attaching a socket filter to their own socket and sending a loopback packet. No victim action is involved.

S:UScope, unchanged

The corruption and its consequences are confined to the kernel's own security authority; there is no VM, IOMMU, or sandbox boundary crossed. This is standard in-kernel privilege escalation territory.

C:HConfidentiality impact, high

The caller dereferences a verifier-blessed but JIT-corrupted pointer, giving a BPF_LDX read at an attacker-influenced wild address that can land in mapped kernel memory (vmemmap/KFENCE region for bit31-set values); the loaded bytes can be stashed into a BPF map and read out from userspace, yielding kernel memory disclosure.

I:HIntegrity impact, high

The identical primitive works in the store direction — BPF_STX/BPF_ST through the corrupted R0 writes fully attacker-controlled 8-byte values at an attacker-chosen displacement, an out-of-bounds kernel write leverageable for control-flow hijacking.

A:HAvailability impact, high

The upstream commit documents a confirmed kernel panic at the ld.bu instruction from the in-tree verifier test, and the wild-pointer dereference reliably oopses whenever the corrupted address is unmapped.