CVE-2025-37893 [Medium] | Security Vulnerability in Linux Kernel

In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Fix off-by-one error in build_prologue() Vincent reported that running BPF progs with tailcalls on LoongArch causes kernel hard lockup. Debugging the issues shows that the JITed image missing a jirl instruction at the end of the epilogue. There are two passes in JIT compiling, the first pass set the flags and the second pass generates JIT code based on those flags. With BPF progs mixing bpf2bpf and tailcalls, build_prologue() generates N insns in the first pass and then generates N+1 insns in the second pass. This makes epilogue_offset off by one and we will jump to some unexpected insn and cause lockup. Fix this by inserting a nop insn.

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2026-05-27	0.06%	0.02%	-0.04%
2	2026-02-12	0.02%	0.06%	+0.04%
3	2025-04-18	—	0.02%	—

Date

Old EPSS score

New EPSS score

Delta (New - Old)

2026-05-27

0.06%

0.02%

-0.04%

2026-02-12

0.02%

0.06%

+0.04%

2025-04-18

—

0.02%

—

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
5.5	3.1	MEDIUM	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H` Click to expand Attack vector (AV:L) They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by. Attack complexity (AC:L) Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup. Privileges required (PR:L) A normal user session is enough; they don’t have to be admin. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:N) Doesn’t really leak secrets in a meaningful way. Integrity (I:N) Data isn’t meaningfully altered or forged. Availability (A:H) Could take the service down hard or make it unusable for people who depend on it.	1.8	3.6	[email protected]
5.5	3.1	MEDIUM	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H` Click to expand Attack vector (AV:L) They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by. Attack complexity (AC:L) Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup. Privileges required (PR:L) A normal user session is enough; they don’t have to be admin. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:N) Doesn’t really leak secrets in a meaningful way. Integrity (I:N) Data isn’t meaningfully altered or forged. Availability (A:H) Could take the service down hard or make it unusable for people who depend on it.	1.8	3.6	134c704f-9b21-4f2e-91b3-4a467353bcc0

Base score

Version

Severity

Vector

Exploitability

Impact

Score source

5.5

3.1

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Click to expand

Attack vector (AV:L): They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by.
Attack complexity (AC:L): Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:L): A normal user session is enough; they don’t have to be admin.
User interaction (UI:N): Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U): Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:N): Doesn’t really leak secrets in a meaningful way.
Integrity (I:N): Data isn’t meaningfully altered or forged.
Availability (A:H): Could take the service down hard or make it unusable for people who depend on it.

1.8

3.6

[email protected]

5.5

3.1

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Click to expand

Attack vector (AV:L): They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by.
Attack complexity (AC:L): Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:L): A normal user session is enough; they don’t have to be admin.
User interaction (UI:N): Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U): Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:N): Doesn’t really leak secrets in a meaningful way.
Integrity (I:N): Data isn’t meaningfully altered or forged.
Availability (A:H): Could take the service down hard or make it unusable for people who depend on it.

1.8

3.6

134c704f-9b21-4f2e-91b3-4a467353bcc0

OS Trackers for CVE-2025-37893

vendor	priority	summary	link
`debian`	unimportant	CVE-2025-37893 unimportant priority: Debian including 1 source packages (linux), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 4, open 1.	https://security-tracker.debian.org/tracker/CVE-2025-37893
`redhat`	medium	—	https://access.redhat.com/security/cve/CVE-2025-37893
`suse`	medium	CVE-2025-37893 severity moderate: SUSE including 26 source package names (cluster-md-kmp-default, dlm-kmp-default, …), 241 product×package rows across 44 product lines (SLES-LTSS-TERADATA 15 SP2, SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS, … (44 product lines)): Known Not Affected 241.	https://www.suse.com/security/cve/CVE-2025-37893/
`ubuntu`	medium	CVE-2025-37893 medium priority: Ubuntu including 150 source packages (linux, linux-allwinner-5.19, …), 1482 status rows across 10 suites (bionic, focal, jammy, noble, oracular, plucky, questing, trusty, upstream, xenial): DNE 1092, ignored 156, not-affected 144, released 90.	https://ubuntu.com/security/CVE-2025-37893

Affected software / configurations for CVE-2025-37893

Vendor	Product	Version	Raw CPE
linux	linux_kernel	>= 6.1, < 6.1.134	cpe:2.3:o:linux:linux_kernel::::::::
linux	linux_kernel	>= 6.2, < 6.6.87	cpe:2.3:o:linux:linux_kernel::::::::
linux	linux_kernel	>= 6.7, < 6.12.23	cpe:2.3:o:linux:linux_kernel::::::::
linux	linux_kernel	>= 6.13, < 6.13.11	cpe:2.3:o:linux:linux_kernel::::::::
linux	linux_kernel	>= 6.14, < 6.14.2	cpe:2.3:o:linux:linux_kernel::::::::

References for CVE-2025-37893

URL	Tags
https://git.kernel.org/stable/c/205a2182c51ffebaef54d643e3745e720cded08b	Patch
https://git.kernel.org/stable/c/48b904de2408af5f936f0e03f48dfcddeab58aa0	Patch
https://git.kernel.org/stable/c/7e2586991e36663c9bc48c828b83eab180ad30a9	Patch
https://git.kernel.org/stable/c/b3ffad2f02db4aace6799fe0049508b8925eae45	Patch
https://git.kernel.org/stable/c/c74d95a5679741ef428974ab788f5b0758dc78ae	Patch

URL

CVE-2025-37893 | LoongArch: BPF: Fix off-by-one error in build_prologue()

Exploit prediction scoring system (EPSS) score for CVE-2025-37893

Common vulnerability scoring system (CVSS) metrics for CVE-2025-37893

Weakness enumeration for CVE-2025-37893

OS Trackers for CVE-2025-37893

Affected software / configurations for CVE-2025-37893

References for CVE-2025-37893