CVE-2025-37893 LoongArch: BPF: Fix off-by-one error in build_prologue()
A local attacker can cause a kernel hard lockup on LoongArch systems by executing BPF programs with tailcalls due to an off-by-one error in the JIT compiler.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-37893?
CVE-2025-37893 is a high-severity denial of service vulnerability in Linux kernel, published on 18 Apr 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
LoongArch: BPF: Fix off-by-one error in build_prologue()
Vincent reported that running BPF progs with tailcalls on LoongArch causes kernel hard lockup. Debugging the issues shows that the JITed image missing a jirl instruction at the end of the epilogue.
There are two passes in JIT compiling, the first pass set the flags and the second pass generates JIT code based on those flags. With BPF progs mixing bpf2bpf and tailcalls, build_prologue() generates N insns in the first pass and then generates N+1 insns in the second pass. This makes epilogue_offset off by one and we will jump to some unexpected insn and cause lockup. Fix this by inserting a nop insn.
Weakness: CWE-193
Which versions are affected by CVE-2025-37893?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-37893?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-37893 being exploited?
There is no known exploitation of CVE-2025-37893 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-61445, BELL-CVE-2025-37893, DEBIAN-CVE-2025-37893, GHSA-3xjw-75cj-9fvw, ROOT-OS-DEBIAN-12-CVE-2025-37893, UBUNTU-CVE-2025-37893.