CVE-2025-38723

Vulnerability

In the Linux kernel, a vulnerability was found in the BPF JIT compiler for the LoongArch architecture. The issue occurs during the extra pass of bpf_int_jit_compile(), which skips JIT context initialization. This omission leaves out_offset set to -1, causing the jmp_offset in emit_bpf_tail_call to be calculated as a negative number. The resulting assembly instructions contain incorrect jump offsets, as shown in the official description shows.

##The vulnerability is triggered when a BPF program uses tail calls. The incorrect jump offset calculation leads to malformed jump instructions in the generated native code. The attack surface is limited to systems running the Linux kernel on LoongArch architecture that load and execute BPF programs with tail calls. No special privileges are required beyond the ability to load BPF programs, which typically requires CAP_BPF or root access.

##The impact of this vulnerability is a system soft lockup, as demonstrated by the tailcalls/tailcall_bpf2bpf_2bpf_1 test in the BPF selftests. The malformed jump instructions cause the CPU to enter an infinite loop or stall, leading to a denial of service condition. The kernel watchdog reports a soft lockup, effectively freezing the affected CPU core.

##The fix has been applied to the Linux kernel stable tree. Patches are available in commits such as `9262e3e04621, 1a782fa32e64, and cd39d9e6b7e4 [2][3][4]. Users should update their kernels to include these patches. The vulnerability is also listed in Siemens advisory SSA-032379 as affecting SIMATIC CN 4100 devices [1], indicating that downstream products may need updates.