CVE-2025-37948: arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs

Q: What is the severity of CVE-2025-37948?

CVE-2025-37948 has a high severity rating due to its potential to allow a malicious BPF program to manipulate branch history predictions.

Q: How do I fix CVE-2025-37948?

Fix CVE-2025-37948 by updating to the latest version of the Linux kernel that contains the mitigation for this vulnerability.

Q: What type of systems are affected by CVE-2025-37948?

CVE-2025-37948 affects systems running the vulnerable versions of the Linux kernel with the arm64 architecture.

Q: What are the potential implications of CVE-2025-37948?

The implications of CVE-2025-37948 include the risk of privilege escalation or manipulation of system behavior by exploiting branch prediction inaccuracies.

Q: Is there any workaround for CVE-2025-37948?

Currently, there are no recommended workarounds for CVE-2025-37948 other than applying the security patches provided in the kernel updates.

Published May 20, 2025

Updated

In the Linux kernel, the following vulnerability has been resolved:

arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs

A malicious BPF program may manipulate the branch history to influence what the hardware speculates will happen next.

On exit from a BPF program, emit the BHB mititgation sequence.

This is only applied for 'classic' cBPF programs that are loaded by seccomp.

Affected Software

236 affected componentsFixes available

Linux Kernel

Linux Linux kernel<5.10.239

Linux Linux kernel>=5.11<5.15.186

Linux Linux kernel>=5.16<6.1.139

Linux Linux kernel>=6.2<6.6.91

Linux Linux kernel>=6.7<6.12.29

Linux Linux kernel>=6.13<6.14.7

Linux Linux kernel=6.15-rc1

Linux Linux kernel=6.15-rc2

Linux Linux kernel=6.15-rc3

Linux Linux kernel=6.15-rc4

Linux Linux kernel=6.15-rc5

Linux Linux kernel=6.15-rc6

Debian Debian Linux=11.0

debian/linux

6.1.176-16.1.190-16.12.107-16.12.115-27.2.12-17.2.15-1

ubuntu/linux*

ubuntu/linux-aws*

ubuntu/linux-azure*

ubuntu/linux-lts-xenial*

ubuntu/linux*

ubuntu/linux-aws*

ubuntu/linux-aws-hwe*

ubuntu/linux-azure*

ubuntu/linux-gcp*

ubuntu/linux-hwe*

ubuntu/linux-hwe-edge*

ubuntu/linux-kvm*

ubuntu/linux-oracle*

ubuntu/linux-fips*

ubuntu/linux*

ubuntu/linux-aws*

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-aws-5.4*

ubuntu/linux-azure*

ubuntu/linux-azure-4.15*

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-5.4*

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-4.15*

ubuntu/linux-gcp-5.3*

ubuntu/linux-gcp-5.4*

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-hwe-5.4*

ubuntu/linux-hwe-edge*

ubuntu/linux-ibm-5.4*

ubuntu/linux-kvm*

ubuntu/linux-oem*

ubuntu/linux-oracle*

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-oracle-5.4*

ubuntu/linux-raspi-5.4*

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux*

ubuntu/linux-aws*

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.15<5.15.0-1092.99~20.04.1

5.15.0-1092.99~20.04.1

ubuntu/linux-aws-5.8*

ubuntu/linux-azure*

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.15<5.15.0-1096.105~20.04.1

5.15.0-1096.105~20.04.1

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-bluefield*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.15<5.15.0-1092.101~20.04.1

5.15.0-1092.101~20.04.1

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-gkeop*

ubuntu/linux-gkeop-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.15<5.15.0-156.166~20.04.1

5.15.0-156.166~20.04.1

ubuntu/linux-hwe-5.8*

ubuntu/linux-ibm*

ubuntu/linux-ibm-5.15<5.15.0-1086.89~20.04.1

5.15.0-1086.89~20.04.1

ubuntu/linux-intel-5.13*

ubuntu/linux-intel-iotg-5.15<5.15.0-1087.93~20.04.1

5.15.0-1087.93~20.04.1

ubuntu/linux-iot*

ubuntu/linux-kvm*

ubuntu/linux-lowlatency-hwe-5.15<5.15.0-156.166~20.04.1

5.15.0-156.166~20.04.1

ubuntu/linux-nvidia-tegra-5.15<5.15.0-1045.45~20.04.1

5.15.0-1045.45~20.04.1

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle*

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.15<5.15.0-1090.96~20.04.1

5.15.0-1090.96~20.04.1

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.15<5.15.0-1087.91~20.04.1

5.15.0-1087.91~20.04.1

ubuntu/linux-riscv-5.8*

ubuntu/linux-xilinx-zynqmp*

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux<5.15.0-156.166

5.15.0-156.166

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws<5.15.0-1092.99

5.15.0-1092.99

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-aws-6.5*

ubuntu/linux-aws-6.8<6.8.0-1046.49~22.04.1

6.8.0-1046.49~22.04.1

ubuntu/linux-azure<5.15.0-1096.105

5.15.0-1096.105

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-6.5*

ubuntu/linux-azure-6.8<6.8.0-1051.57~22.04.1

6.8.0-1051.57~22.04.1

ubuntu/linux-azure-fde<5.15.0-1096.105.1

5.15.0-1096.105.1

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-azure-fde-6.8<6.8.0-1046.53~22.04.1

6.8.0-1046.53~22.04.1

ubuntu/linux-gcp<5.15.0-1092.101

5.15.0-1092.101

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-gcp-6.5*

ubuntu/linux-gcp-6.8<6.8.0-1047.50~22.04.2

6.8.0-1047.50~22.04.2

ubuntu/linux-gke<5.15.0-1089.95

5.15.0-1089.95

ubuntu/linux-gkeop<5.15.0-1075.83

5.15.0-1075.83

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-hwe-6.5*

ubuntu/linux-hwe-6.8<6.8.0-100.100~22.04.1

6.8.0-100.100~22.04.1

ubuntu/linux-ibm<5.15.0-1086.89

5.15.0-1086.89

ubuntu/linux-ibm-6.8<6.8.0-1044.44~22.04.1

6.8.0-1044.44~22.04.1

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-intel-iotg<5.15.0-1087.93

5.15.0-1087.93

ubuntu/linux-kvm<5.15.0-1088.93

5.15.0-1088.93

ubuntu/linux-lowlatency<5.15.0-156.166

5.15.0-156.166

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-lowlatency-hwe-6.5*

ubuntu/linux-lowlatency-hwe-6.8<6.8.0-100.100.1~22.04.1

6.8.0-100.100.1~22.04.1

ubuntu/linux-nvidia<5.15.0-1087.88

5.15.0-1087.88

ubuntu/linux-nvidia-6.2*

ubuntu/linux-nvidia-6.5*

ubuntu/linux-nvidia-6.8<6.8.0-1046.49~22.04.1

6.8.0-1046.49~22.04.1

ubuntu/linux-nvidia-tegra<5.15.0-1045.45

5.15.0-1045.45

ubuntu/linux-nvidia-tegra-igx<5.15.0-1034.34

5.15.0-1034.34

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-oem-6.5*

ubuntu/linux-oracle<5.15.0-1090.96

5.15.0-1090.96

ubuntu/linux-oracle-6.5*

ubuntu/linux-oracle-6.8<6.8.0-1043.44~22.04.1

6.8.0-1043.44~22.04.1

ubuntu/linux-raspi<5.15.0-1086.89

5.15.0-1086.89

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-riscv-6.5*

ubuntu/linux-riscv-6.8<6.8.0-100.100~22.04.1

6.8.0-100.100~22.04.1

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-starfive-6.5*

ubuntu/linux-xilinx-zynqmp<5.15.0-1056.60

5.15.0-1056.60

ubuntu/linux-bluefield<5.15.0-1076.78

5.15.0-1076.78

ubuntu/linux-intel-iot-realtime<5.15.0-1085.87

5.15.0-1085.87

ubuntu/linux-realtime<5.15.0-1092.101

5.15.0-1092.101

ubuntu/linux-realtime-6.8<6.8.1-1041.42~22.04.1

6.8.1-1041.42~22.04.1

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux-aws-fips<5.15.0-1092.99+fips1

5.15.0-1092.99+fips1

ubuntu/linux-azure-fips<5.15.0-1096.105+fips1

5.15.0-1096.105+fips1

ubuntu/linux-fips<5.15.0-156.166+fips1

5.15.0-156.166+fips1

ubuntu/linux-gcp-fips<5.15.0-1092.101+fips1

5.15.0-1092.101+fips1

ubuntu/linux<6.8.0-100.100

6.8.0-100.100

ubuntu/linux-aws<6.8.0-1046.49

6.8.0-1046.49

ubuntu/linux-aws-6.14<6.14.0-1011.11~24.04.1

6.14.0-1011.11~24.04.1

ubuntu/linux-azure<6.8.0-1046.52

6.8.0-1046.52

ubuntu/linux-azure-6.11*

ubuntu/linux-azure-fde<6.8.0-1046.53

6.8.0-1046.53

ubuntu/linux-azure-nvidia*

ubuntu/linux-gcp<6.8.0-1047.50

6.8.0-1047.50

ubuntu/linux-gcp-6.11*

ubuntu/linux-gcp-6.14<6.14.0-1014.15~24.04.1

6.14.0-1014.15~24.04.1

ubuntu/linux-gke<6.8.0-1043.48

6.8.0-1043.48

ubuntu/linux-gkeop<6.8.0-1030.33

6.8.0-1030.33

ubuntu/linux-hwe-6.11*

ubuntu/linux-ibm<6.8.0-1044.44

6.8.0-1044.44

ubuntu/linux-intel*

ubuntu/linux-lowlatency<6.8.0-100.100.1

6.8.0-100.100.1

ubuntu/linux-lowlatency-hwe-6.11*

ubuntu/linux-nvidia<6.8.0-1046.49

6.8.0-1046.49

ubuntu/linux-nvidia-6.11*

ubuntu/linux-nvidia-lowlatency<6.8.0-1046.49.1

6.8.0-1046.49.1

ubuntu/linux-nvidia-tegra<6.8.0-1020.20

6.8.0-1020.20

ubuntu/linux-oem-6.11*

ubuntu/linux-oem-6.14<6.14.0-1010.10

6.14.0-1010.10

ubuntu/linux-oem-6.8*

ubuntu/linux-oracle<6.8.0-1043.44

6.8.0-1043.44

ubuntu/linux-oracle-6.14<6.14.0-1011.11~24.04.1

6.14.0-1011.11~24.04.1

ubuntu/linux-raspi<6.8.0-1047.51

6.8.0-1047.51

ubuntu/linux-raspi-realtime*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-6.14<6.14.0-28.28.1~24.04.1

6.14.0-28.28.1~24.04.1

ubuntu/linux-xilinx<6.8.0-1023.24

6.8.0-1023.24

ubuntu/linux-bluefield<6.8.0-1016.20

6.8.0-1016.20

ubuntu/linux-raspi-realtime<6.8.0-2037.38

6.8.0-2037.38

ubuntu/linux-realtime<6.8.1-1041.42

6.8.1-1041.42

ubuntu/linux-realtime-6.14<6.14.0-1010.10~24.04.1

6.14.0-1010.10~24.04.1

ubuntu/linux-aws-fips<6.8.0-1046.49+fips1

6.8.0-1046.49+fips1

ubuntu/linux-azure-fips<6.8.0-1046.52+fips1

6.8.0-1046.52+fips1

ubuntu/linux-fips<6.8.0-100.100+fips1

6.8.0-100.100+fips1

ubuntu/linux-gcp-fips<6.8.0-1047.50+fips1

6.8.0-1047.50+fips1

ubuntu/linux-azure-fde*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/linux to a version that resolves this vulnerability.
Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1
Upgrade
Upgrade ubuntu/linux-aws-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1092.99~20.04.1
Upgrade
Upgrade ubuntu/linux-azure-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1096.105~20.04.1
Upgrade
Upgrade ubuntu/linux-gcp-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1092.101~20.04.1
Upgrade
Upgrade ubuntu/linux-hwe-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-156.166~20.04.1
Upgrade
Upgrade ubuntu/linux-ibm-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1086.89~20.04.1
Upgrade
Upgrade ubuntu/linux-intel-iotg-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1087.93~20.04.1
Upgrade
Upgrade ubuntu/linux-lowlatency-hwe-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-156.166~20.04.1
Upgrade
Upgrade ubuntu/linux-nvidia-tegra-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1045.45~20.04.1
Upgrade
Upgrade ubuntu/linux-oracle-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1090.96~20.04.1
Upgrade
Upgrade ubuntu/linux-riscv-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1087.91~20.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 5.15.0-156.166
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 5.15.0-1092.99
Upgrade
Upgrade ubuntu/linux-aws-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1046.49~22.04.1
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 5.15.0-1096.105
Upgrade
Upgrade ubuntu/linux-azure-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1051.57~22.04.1
Upgrade
Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.
Fixed in 5.15.0-1096.105.1
Upgrade
Upgrade ubuntu/linux-azure-fde-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1046.53~22.04.1
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 5.15.0-1092.101
Upgrade
Upgrade ubuntu/linux-gcp-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1047.50~22.04.2
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 5.15.0-1089.95
Upgrade
Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.
Fixed in 5.15.0-1075.83
Upgrade
Upgrade ubuntu/linux-hwe-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-100.100~22.04.1
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 5.15.0-1086.89
Upgrade
Upgrade ubuntu/linux-ibm-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1044.44~22.04.1
Upgrade
Upgrade ubuntu/linux-intel-iotg to a version that resolves this vulnerability.
Fixed in 5.15.0-1087.93
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 5.15.0-1088.93
Upgrade
Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.
Fixed in 5.15.0-156.166
Upgrade
Upgrade ubuntu/linux-lowlatency-hwe-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-100.100.1~22.04.1
Upgrade
Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.
Fixed in 5.15.0-1087.88
Upgrade
Upgrade ubuntu/linux-nvidia-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1046.49~22.04.1
Upgrade
Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.
Fixed in 5.15.0-1045.45
Upgrade
Upgrade ubuntu/linux-nvidia-tegra-igx to a version that resolves this vulnerability.
Fixed in 5.15.0-1034.34
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 5.15.0-1090.96
Upgrade
Upgrade ubuntu/linux-oracle-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1043.44~22.04.1
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 5.15.0-1086.89
Upgrade
Upgrade ubuntu/linux-riscv-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-100.100~22.04.1
Upgrade
Upgrade ubuntu/linux-xilinx-zynqmp to a version that resolves this vulnerability.
Fixed in 5.15.0-1056.60
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 5.15.0-1076.78
Upgrade
Upgrade ubuntu/linux-intel-iot-realtime to a version that resolves this vulnerability.
Fixed in 5.15.0-1085.87
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 5.15.0-1092.101
Upgrade
Upgrade ubuntu/linux-realtime-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.1-1041.42~22.04.1
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-1092.99+fips1
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-1096.105+fips1
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-156.166+fips1
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-1092.101+fips1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 6.8.0-100.100
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 6.8.0-1046.49
Upgrade
Upgrade ubuntu/linux-aws-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-1011.11~24.04.1
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 6.8.0-1046.52
Upgrade
Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.
Fixed in 6.8.0-1046.53
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 6.8.0-1047.50
Upgrade
Upgrade ubuntu/linux-gcp-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-1014.15~24.04.1
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 6.8.0-1043.48
Upgrade
Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.
Fixed in 6.8.0-1030.33
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 6.8.0-1044.44
Upgrade
Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.
Fixed in 6.8.0-100.100.1
Upgrade
Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.
Fixed in 6.8.0-1046.49
Upgrade
Upgrade ubuntu/linux-nvidia-lowlatency to a version that resolves this vulnerability.
Fixed in 6.8.0-1046.49.1
Upgrade
Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.
Fixed in 6.8.0-1020.20
Upgrade
Upgrade ubuntu/linux-oem-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-1010.10
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 6.8.0-1043.44
Upgrade
Upgrade ubuntu/linux-oracle-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-1011.11~24.04.1
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 6.8.0-1047.51
Upgrade
Upgrade ubuntu/linux-riscv-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-28.28.1~24.04.1
Upgrade
Upgrade ubuntu/linux-xilinx to a version that resolves this vulnerability.
Fixed in 6.8.0-1023.24
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 6.8.0-1016.20
Upgrade
Upgrade ubuntu/linux-raspi-realtime to a version that resolves this vulnerability.
Fixed in 6.8.0-2037.38
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 6.8.1-1041.42
Upgrade
Upgrade ubuntu/linux-realtime-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-1010.10~24.04.1
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1046.49+fips1
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1046.52+fips1
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-100.100+fips1
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1047.50+fips1

Event History

May 20, 2025

CVE Published

via MITRE·04:01 PM

Data Sourced

via MITRE·04:01 PM

Description

Data Sourced

via OSV·04:15 PM

DescriptionSeverityAffected Software

Event

via OSV·04:15 PM

Data Sourced

via NVD·04:15 PM

RemedyDescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

DSA-5925

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is the severity of CVE-2025-37948?

CVE-2025-37948 has a high severity rating due to its potential to allow a malicious BPF program to manipulate branch history predictions.

How do I fix CVE-2025-37948?

Fix CVE-2025-37948 by updating to the latest version of the Linux kernel that contains the mitigation for this vulnerability.

What type of systems are affected by CVE-2025-37948?

CVE-2025-37948 affects systems running the vulnerable versions of the Linux kernel with the arm64 architecture.

What are the potential implications of CVE-2025-37948?

The implications of CVE-2025-37948 include the risk of privilege escalation or manipulation of system behavior by exploiting branch prediction inaccuracies.

Is there any workaround for CVE-2025-37948?

Currently, there are no recommended workarounds for CVE-2025-37948 other than applying the security patches provided in the kernel updates.

CVE-2025-37948: arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2025-37948?

How do I fix CVE-2025-37948?

What type of systems are affected by CVE-2025-37948?

What are the potential implications of CVE-2025-37948?

Is there any workaround for CVE-2025-37948?

Company

Resources

Contact