CVE-2025-38723: LoongArch: BPF: Fix jump offset calculation in tailcall
In the Linux kernel, the following vulnerability has been resolved:
LoongArch: BPF: Fix jump offset calculation in tailcall
The extra pass of bpfintjitcompile() skips JIT context initialization which essentially skips offset calculation leaving outoffset = -1, so the jmpoffset in emitbpftailcall is calculated by
"#define jmpoffset (outoffset - (curoffset))"
is a negative number, which is wrong. The final generated assembly are as follow.
54: bgeu $a2, $t1, -8 # 0x0000004c 58: addi.d $a6, $s5, -1 5c: bltz $a6, -16 # 0x0000004c 60: alsl.d $t2, $a2, $a1, 0x3 64: ld.d $t2, $t2, 264 68: beq $t2, $zero, -28 # 0x0000004c
Before apply this patch, the follow test case will reveal soft lock issues.
cd tools/testing/selftests/bpf/ ./testprogs --allow=tailcalls/tailcallbpf2bpf1
dmesg: watchdog: BUG: soft lockup - CPU#2 stuck for 26s! [testprogs:25056]
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38723?
CVE-2025-38723 has a severity level that indicates potential security implications due to improper jump offset calculation in the Linux kernel.
How do I fix CVE-2025-38723?
To fix CVE-2025-38723, update the Linux kernel to the latest version where the vulnerability has been addressed.
What systems are affected by CVE-2025-38723?
CVE-2025-38723 affects systems running the affected versions of the Linux kernel, particularly those using the LoongArch architecture.
What impact does CVE-2025-38723 have on system security?
CVE-2025-38723 can potentially lead to erroneous behavior in BPF jump offset calculations, which might compromise the integrity of programs that rely heavily on this feature.
Is CVE-2025-38723 a critical vulnerability?
CVE-2025-38723 is considered a serious vulnerability but its criticality may vary based on specific system configurations and use cases.