CVE-2025-37963
Estado: AnalizadaMedia (5.5)—
In the Linux kernel, the following vulnerability has been resolved:
arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users
Support for eBPF programs loaded by unprivileged users is typically disabled. This means only cBPF programs need to be mitigated for BHB.
In addition, only mitigate cBPF programs that were loaded by an unprivileged user. Privileged users can also load the same program via eBPF, making the mitigation pointless.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Puntuación base: 5.5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.19%
- Percentil entre todas las CVEs puntuadas: 8
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (2)
CWE
- NVD-CWE-noinfo
Referencias
- https://git.kernel.org/stable/c/038866e01ea5e5a3d948898ac216e531e7848669
- https://git.kernel.org/stable/c/477481c4348268136227348984b6699d6370b685
- https://git.kernel.org/stable/c/6e52d043f7dbf1839a24a3fab2b12b0d3839de7a
- https://git.kernel.org/stable/c/80251f62028f1ab2e09be5ca3123f84e8b00389a
- https://git.kernel.org/stable/c/df53d418709205450a02bb4d71cbfb4ff86f2c1e
- https://git.kernel.org/stable/c/e5f5100f1c64ac6c72671b2cf6b46542fce93706
- https://git.kernel.org/stable/c/f300769ead032513a68e4a02e806393402e626f8
- https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html
JSON original (NVD)
Mostrar
{
"id": "CVE-2025-37963",
"cveTags": [],
"metrics": {
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 5.5,
"attackVector": "LOCAL",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 1.8
}
]
},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "0be7320a635c2e434e8b67e0e9474a85ceb421c4",
"lessThan": "038866e01ea5e5a3d948898ac216e531e7848669",
"versionType": "git"
},
{
"status": "affected",
"version": "0be7320a635c2e434e8b67e0e9474a85ceb421c4",
"lessThan": "df53d418709205450a02bb4d71cbfb4ff86f2c1e",
"versionType": "git"
},
{
"status": "affected",
"version": "0be7320a635c2e434e8b67e0e9474a85ceb421c4",
"lessThan": "6e52d043f7dbf1839a24a3fab2b12b0d3839de7a",
"versionType": "git"
},
{
"status": "affected",
"version": "0be7320a635c2e434e8b67e0e9474a85ceb421c4",
"lessThan": "80251f62028f1ab2e09be5ca3123f84e8b00389a",
"versionType": "git"
},
{
"status": "affected",
"version": "0be7320a635c2e434e8b67e0e9474a85ceb421c4",
"lessThan": "e5f5100f1c64ac6c72671b2cf6b46542fce93706",
"versionType": "git"
},
{
"status": "affected",
"version": "0be7320a635c2e434e8b67e0e9474a85ceb421c4",
"lessThan": "477481c4348268136227348984b6699d6370b685",
"versionType": "git"
},
{
"status": "affected",
"version": "0be7320a635c2e434e8b67e0e9474a85ceb421c4",
"lessThan": "f300769ead032513a68e4a02e806393402e626f8",
"versionType": "git"
}
],
"programFiles": [
"arch/arm64/net/bpf_jit_comp.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "3.7"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "3.7",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.239",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.186",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.139",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.91",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.29",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.14.7",
"versionType": "semver",
"lessThanOrEqual": "6.14.*"
},
{
"status": "unaffected",
"version": "6.15",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"arch/arm64/net/bpf_jit_comp.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2025-05-20T16:15:34.580",
"references": [
{
"url": "https://git.kernel.org/stable/c/038866e01ea5e5a3d948898ac216e531e7848669",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/477481c4348268136227348984b6699d6370b685",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/6e52d043f7dbf1839a24a3fab2b12b0d3839de7a",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/80251f62028f1ab2e09be5ca3123f84e8b00389a",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/df53d418709205450a02bb4d71cbfb4ff86f2c1e",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/e5f5100f1c64ac6c72671b2cf6b46542fce93706",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/f300769ead032513a68e4a02e806393402e626f8",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Analyzed",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: bpf: Only mitigate cBPF programs loaded by unprivileged users\n\nSupport for eBPF programs loaded by unprivileged users is typically\ndisabled. This means only cBPF programs need to be mitigated for BHB.\n\nIn addition, only mitigate cBPF programs that were loaded by an\nunprivileged user. Privileged users can also load the same program\nvia eBPF, making the mitigation pointless."
},
{
"lang": "es",
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: arm64: bpf: Mitigar solo programas cBPF cargados por usuarios sin privilegios. La compatibilidad con programas eBPF cargados por usuarios sin privilegios suele estar deshabilitada. Esto significa que solo es necesario mitigar los programas cBPF para BHB. Además, solo se deben mitigar los programas cBPF cargados por un usuario sin privilegios. Los usuarios con privilegios también pueden cargar el mismo programa mediante eBPF, lo que hace que la mitigación sea inútil."
}
],
"lastModified": "2026-06-17T09:15:47.177",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EA6682C5-339B-4473-BFD0-3B4AB58495B3",
"versionEndExcluding": "5.10.239"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D96F2C0D-0D4A-4658-AD34-D8A626EA422D",
"versionEndExcluding": "5.15.186",
"versionStartIncluding": "5.11"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "70A2F216-574B-4B80-86BC-988928D5B83D",
"versionEndExcluding": "6.1.139",
"versionStartIncluding": "5.16"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B6826C73-C5C9-430D-84C9-4045DFD72074",
"versionEndExcluding": "6.6.91",
"versionStartIncluding": "6.2"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7215ABCF-8EB1-46CD-8872-8BCE4890E579",
"versionEndExcluding": "6.12.29",
"versionStartIncluding": "6.7"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5715A6F5-A34A-4B27-8A64-82825E963995",
"versionEndExcluding": "6.14.7",
"versionStartIncluding": "6.13"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8D465631-2980-487A-8E65-40AE2B9F8ED1"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4C9D071F-B28E-46EC-AC61-22B913390211"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "13FC0DDE-E513-465E-9E81-515702D49B74"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8C7B5B0E-4EEB-48F5-B4CF-0935A7633845"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc5:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2D240580-3048-49B2-9E27-F115A9DF8224"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc6:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "90320558-E553-4EF5-8A0B-0F5D20113BD2"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}