CVE-2025-37893

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The vulnerability is triggered through the bpf(BPF_PROG_LOAD) syscall when the LoongArch JIT compiles an attacker-supplied program, and the miscompiled image is executed via a locally attached socket filter. Per kernel scoring guidance, BPF is a local attack vector.

AC:LAttack complexity, low

The miscompilation is fully deterministic — any program that sets both SAVE_RA and SAVE_TCC (one call plus one tail call) makes build_prologue() emit N+1 instructions in pass 2 versus N in pass 1. No race, no memory-layout luck, and the attacker authors the exact instruction sequence.

PR:LPrivileges required, low

BPF_MAP_TYPE_PROG_ARRAY is an unprivileged map type in map_create(), bpf_tail_call_proto is returned before the CAP_BPF gate in bpf_base_func_proto(), and BPF_PROG_TYPE_SOCKET_FILTER loads without CAP_BPF, so an ordinary local user can reach this where unprivileged BPF is enabled or CAP_BPF is delegated to a service.

UI:NUser interaction, none

The attacker loads and attaches the BPF program to a socket it owns and triggers execution itself; no action by any other user is required.

S:UScope, unchanged

The corruption and the wrong control flow occur inside the kernel's own JIT image and exception table, within the same security authority as the kernel itself.

C:HConfidentiality impact, high

The off-by-one epilogue branch executes an attacker-chosen instruction (e.g. a `ldd` load) with attacker-controlled register operands at kernel privilege, and the corrupted exception-table entry alters kernel fault fixup, both of which can be leveraged to read kernel memory.

I:HIntegrity impact, high

There is a 4-byte out-of-bounds write past prog_size into prog->aux->extable, plus attacker-directed execution of an arbitrary JIT-emitted instruction (including stores) with a mismatched stack frame — a kernel-mode write/control-flow primitive.

A:HAvailability impact, high

The reported and confirmed symptom is a kernel hard lockup, since the mis-targeted branch can loop indefinitely in kernel context; any unprivileged user able to load such a program can wedge the machine.