In the Linux kernel, the following vulnerability has been resolved: arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users Support for eBPF programs loaded by unprivileged users is typically disabled. This means only cBPF programs need to be mitigated for BHB. In addition, only mitigate cBPF programs that were loaded by an unprivileged user. Privileged users can also load the same program via eBPF, making the mitigation pointless.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Linux
  • Linux Kernel

No data.

No data.

References
Link Providers
https://git.kernel.org/stable/c/038866e01ea5e5a3d948898ac216e531e7848669 cve-icon cve-icon
https://git.kernel.org/stable/c/477481c4348268136227348984b6699d6370b685 cve-icon cve-icon
https://git.kernel.org/stable/c/6e52d043f7dbf1839a24a3fab2b12b0d3839de7a cve-icon cve-icon
https://git.kernel.org/stable/c/80251f62028f1ab2e09be5ca3123f84e8b00389a cve-icon cve-icon
https://git.kernel.org/stable/c/df53d418709205450a02bb4d71cbfb4ff86f2c1e cve-icon cve-icon
https://git.kernel.org/stable/c/e5f5100f1c64ac6c72671b2cf6b46542fce93706 cve-icon cve-icon
https://git.kernel.org/stable/c/f300769ead032513a68e4a02e806393402e626f8 cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html cve-icon
https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html cve-icon
https://lore.kernel.org/linux-cve-announce/2025052005-CVE-2025-37963-60f2@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2025-37963 cve-icon
https://www.cve.org/CVERecord?id=CVE-2025-37963 cve-icon
History

Mon, 03 Nov 2025 20:30:00 +0000

Type Values Removed Values Added
References

Mon, 03 Nov 2025 18:30:00 +0000

Type Values Removed Values Added
References

Mon, 14 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.00061}

 epss

{'score': 0.00051}

Fri, 27 Jun 2025 10:45:00 +0000

Type Values Removed Values Added
References

Sat, 14 Jun 2025 14:45:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

 cvssV3_1

{'score': 6.4, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H'}

Thu, 22 May 2025 02:45:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

threat_severity

Moderate

Tue, 20 May 2025 16:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users Support for eBPF programs loaded by unprivileged users is typically disabled. This means only cBPF programs need to be mitigated for BHB. In addition, only mitigate cBPF programs that were loaded by an unprivileged user. Privileged users can also load the same program via eBPF, making the mitigation pointless.
Title arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2025-05-20T16:01:55.322Z

Updated: 2025-11-03T19:57:48.402Z

Reserved: 2025-04-16T04:51:23.974Z

Link: CVE-2025-37963

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-05-20T16:15:34.580

Modified: 2025-11-03T20:18:43.667

Link: CVE-2025-37963

cve-icon Redhat

Severity : Moderate

Publid Date: 2025-05-20T00:00:00Z

Links: CVE-2025-37963 - Bugzilla