CVE-2025-37948

Q: What is the severity of CVE-2025-37948?

CVE-2025-37948 has a CVSS score of 5.5 (MEDIUM). This CVE addresses a speculative execution vulnerability in the Linux kernel's classic BPF (cBPF) implementation on ARM64 systems. A malicious BPF program loaded via seccomp could manipulate branch history to influence hardware speculation, potentially leading to information disclosure. Only systems running Linux kernel on ARM64 architecture with seccomp loading cBPF programs are affected.

5.5 MEDIUM

📋 TL;DR

This CVE addresses a speculative execution vulnerability in the Linux kernel's classic BPF (cBPF) implementation on ARM64 systems. A malicious BPF program loaded via seccomp could manipulate branch history to influence hardware speculation, potentially leading to information disclosure. Only systems running Linux kernel on ARM64 architecture with seccomp loading cBPF programs are affected.

💻 Affected Systems

Products:

Linux Kernel

Versions: Specific affected versions not specified in CVE, but likely affects multiple stable kernel versions before the fix commits.

Operating Systems: Linux distributions running on ARM64 architecture

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects ARM64 systems using classic BPF (cBPF) programs loaded via seccomp. eBPF programs are not affected.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Information disclosure through speculative execution side-channels, potentially leaking sensitive kernel memory or process data to unprivileged attackers.

🟠

Likely Case

Limited information disclosure requiring local access and ability to load malicious BPF programs via seccomp, with exploitation requiring significant technical expertise.

🟢

If Mitigated

Minimal impact if systems are properly patched or don't use seccomp with cBPF programs on ARM64.

🌐 Internet-Facing: LOW - This is a local privilege vulnerability requiring local access to exploit.

🏢 Internal Only: MEDIUM - Internal attackers with local access could potentially exploit this, but requires specific conditions (ARM64, seccomp with cBPF).

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: HIGH

Exploitation requires local access, ability to load BPF programs via seccomp, and understanding of speculative execution attacks. No public exploits known.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions containing commits: 0dfefc2ea2f29ced2416017d7e5b1253a54c2735, 38c345fd54afd9d6ed8d3fcddf3f6ea23887bf78, 42a20cf51011788f04cf2adbcd7681f02bdb6c27, 852b8ae934b5cbdc62496fa56ce9969aa2edda7f, 8fe5c37b0e08a97cf0210bb75970e945aaaeebab

Vendor Advisory: https://git.kernel.org/stable/c/0dfefc2ea2f29ced2416017d7e5b1253a54c2735

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix commits. 2. Reboot system. 3. Verify kernel version after reboot.

🔧 Temporary Workarounds

Disable seccomp BPF filtering

linux

Prevent loading of cBPF programs via seccomp to mitigate the vulnerability.

echo 0 > /proc/sys/kernel/seccomp/actions_logged
echo 0 > /proc/sys/kernel/seccomp/actions_avail

Use eBPF instead of cBPF

linux

Migrate from classic BPF to extended BPF (eBPF) which is not affected by this vulnerability.

🧯 If You Can't Patch

Restrict seccomp usage to trusted applications only
Implement strict access controls to prevent unauthorized users from loading BPF programs

🔍 How to Verify

Check if Vulnerable:

Check if running on ARM64 architecture and if kernel version predates the fix commits: uname -m && uname -r

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes the fix commits: grep -q '0dfefc2ea2f29ced2416017d7e5b1253a54c2735\|38c345fd54afd9d6ed8d3fcddf3f6ea23887bf78\|42a20cf51011788f04cf2adbcd7681f02bdb6c27\|852b8ae934b5cbdc62496fa56ce9969aa2edda7f\|8fe5c37b0e08a97cf0210bb75970e945aaaeebab' /proc/version

📡 Detection & Monitoring

Log Indicators:

Failed attempts to load BPF programs via seccomp
Unusual seccomp filter activity

Network Indicators:

None - this is a local vulnerability

SIEM Query:

source="kernel" AND ("seccomp" OR "BPF") AND ("load" OR "filter")

📊 Metadata

CVE ID: CVE-2025-37948

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS Score: 0.03% exploit probability (9.6th percentile)

Published: May 20, 2025

Last Updated: December 18, 2025

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Debian Linux by Debian

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable seccomp BPF filtering

Use eBPF instead of cBPF

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export