CVE-2025-37963

Q: What is the severity of CVE-2025-37963?

CVE-2025-37963 has a CVSS score of 5.5 (MEDIUM). This CVE addresses a vulnerability in the Linux kernel's BPF subsystem on ARM64 architecture where Branch History Buffer (BHB) mitigations were incorrectly applied to all cBPF programs. The fix ensures mitigations only apply to cBPF programs loaded by unprivileged users, preventing unnecessary performance overhead. Systems running Linux kernel on ARM64 hardware with BPF enabled are affected.

5.5 MEDIUM

📋 TL;DR

This CVE addresses a vulnerability in the Linux kernel's BPF subsystem on ARM64 architecture where Branch History Buffer (BHB) mitigations were incorrectly applied to all cBPF programs. The fix ensures mitigations only apply to cBPF programs loaded by unprivileged users, preventing unnecessary performance overhead. Systems running Linux kernel on ARM64 hardware with BPF enabled are affected.

💻 Affected Systems

Products:

Linux Kernel

Versions: Specific affected kernel versions not specified in CVE, but likely affects recent ARM64 kernels with BPF support before the fix commits.

Operating Systems: Linux distributions running on ARM64 architecture

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects ARM64 (AArch64) systems with BPF enabled. Requires unprivileged BPF loading capability which is typically disabled by default in secure configurations.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

If exploited, this could potentially allow bypass of BHB mitigations for cBPF programs, increasing risk of speculative execution attacks like Spectre-BHB on ARM64 systems.

🟠

Likely Case

Most likely impact is performance degradation due to unnecessary BHB mitigations being applied to privileged cBPF programs, with minimal security impact in properly configured systems.

🟢

If Mitigated

With proper kernel patches applied, only unprivileged cBPF programs receive BHB mitigations, maintaining security while optimizing performance.

🌐 Internet-Facing: LOW - This vulnerability requires local access and specific conditions to potentially impact security.

🏢 Internal Only: MEDIUM - Internal users with unprivileged access could potentially exploit this if other conditions are met, but impact is limited.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: HIGH - Requires local access, understanding of BPF and speculative execution vulnerabilities, and specific system conditions.

Exploitation would require combining this with other vulnerabilities or misconfigurations to achieve meaningful impact.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions containing commits: 038866e01ea5e5a3d948898ac216e531e7848669, 477481c4348268136227348984b6699d6370b685, 6e52d043f7dbf1839a24a3fab2b12b0d3839de7a, 80251f62028f1ab2e09be5ca3123f84e8b00389a, df53d418709205450a02bb4d71cbfb4ff86f2c1e

Vendor Advisory: https://git.kernel.org/stable/c/038866e01ea5e5a3d948898ac216e531e7848669

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix commits. 2. For distributions: Use package manager (apt/yum/dnf) to update kernel. 3. Reboot system to load new kernel.

🔧 Temporary Workarounds

Disable unprivileged BPF

linux

Prevent unprivileged users from loading BPF programs, which eliminates the attack surface.

sysctl -w kernel.unprivileged_bpf_disabled=1
echo 'kernel.unprivileged_bpf_disabled = 1' >> /etc/sysctl.conf
sysctl -p

Disable BPF JIT

linux

Disable BPF Just-In-Time compilation to reduce attack surface.

sysctl -w net.core.bpf_jit_enable=0
echo 'net.core.bpf_jit_enable = 0' >> /etc/sysctl.conf
sysctl -p

🧯 If You Can't Patch

Implement strict access controls to prevent unprivileged users from executing code on affected systems
Monitor for unusual BPF program loading activity and implement least privilege principles

🔍 How to Verify

Check if Vulnerable:

Check kernel version and verify if BPF is enabled: cat /proc/sys/kernel/unprivileged_bpf_disabled (0 means vulnerable if unpatched)

Check Version:

uname -r

Verify Fix Applied:

Check kernel version contains fix commits: uname -r and verify with distribution's changelog

📡 Detection & Monitoring

Log Indicators:

Audit logs showing BPF program loads by unprivileged users
Kernel logs related to BPF operations

Network Indicators:

Not applicable - local vulnerability

SIEM Query:

source="audit.log" AND (bpf OR ebpf) AND user!="root"

📊 Metadata

CVE ID: CVE-2025-37963

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS Score: 0.03% exploit probability (9.6th percentile)

Published: May 20, 2025

Last Updated: December 16, 2025

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Debian Linux by Debian

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable unprivileged BPF

Disable BPF JIT

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export