CVE-2025-37893
📋 TL;DR
A Linux kernel vulnerability in the LoongArch BPF JIT compiler causes an off-by-one error in build_prologue() when handling BPF programs with tailcalls. This can lead to kernel hard lockups (system freezes) on affected LoongArch systems. Only systems running Linux kernel with LoongArch architecture support are affected.
💻 Affected Systems
- Linux kernel
📦 What is this software?
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Complete system lockup requiring hard reboot, potentially causing denial of service and data loss in critical systems.
Likely Case
System becomes unresponsive when running specific BPF programs with tailcalls, requiring reboot to restore functionality.
If Mitigated
No impact if BPF programs with tailcalls are not executed on LoongArch systems.
🎯 Exploit Status
Requires ability to load BPF programs with tailcalls on LoongArch systems. Typically requires CAP_BPF or root privileges.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Kernel versions containing the fix commits (205a2182c51ffebaef54d643e3745e720cded08b and related)
Vendor Advisory: https://git.kernel.org/stable/c/205a2182c51ffebaef54d643e3745e720cded08b
Restart Required: Yes
Instructions:
1. Update Linux kernel to version containing the fix commits. 2. For distributions: Use package manager to update kernel package. 3. Reboot system to load new kernel.
🔧 Temporary Workarounds
Disable BPF JIT on LoongArch
linuxDisable BPF JIT compilation to prevent the vulnerable code path
echo 0 > /proc/sys/net/core/bpf_jit_enable
Restrict BPF program loading
linuxLimit BPF program loading capabilities to trusted users only
Use Linux capabilities or SELinux/AppArmor to restrict CAP_BPF
🧯 If You Can't Patch
- Disable BPF JIT compilation via sysctl
- Implement strict access controls to prevent untrusted users from loading BPF programs
🔍 How to Verify
Check if Vulnerable:
Check if running on LoongArch architecture and kernel version is before fix commits: uname -m && uname -rCheck Version:
uname -rVerify Fix Applied:
Verify kernel version includes the fix commits and test BPF programs with tailcalls no longer cause lockups📡 Detection & Monitoring
Log Indicators:
- Kernel panic messages
- System lockup events in syslog
- BPF program loading failures
Network Indicators:
- None - local vulnerability only
SIEM Query:
Search for: 'kernel panic' OR 'hard lockup' OR 'BPF' AND 'LoongArch' in system logs🔗 References
- https://git.kernel.org/stable/c/205a2182c51ffebaef54d643e3745e720cded08b
- https://git.kernel.org/stable/c/48b904de2408af5f936f0e03f48dfcddeab58aa0
- https://git.kernel.org/stable/c/7e2586991e36663c9bc48c828b83eab180ad30a9
- https://git.kernel.org/stable/c/b3ffad2f02db4aace6799fe0049508b8925eae45
- https://git.kernel.org/stable/c/c74d95a5679741ef428974ab788f5b0758dc78ae
