CVE-2025-37822

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-37822", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:23.947Z", "datePublished": "2025-05-08T06:26:16.209Z", "dateUpdated": "2026-10-15T21:52:01.328Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:57:45.691Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: uprobes: Add missing fence.i after building the XOL buffer\n\nThe XOL (execute out-of-line) buffer is used to single-step the\nreplaced instruction(s) for uprobes. The RISC-V port was missing a\nproper fence.i (i$ flushing) after constructing the XOL buffer, which\ncan result in incorrect execution of stale/broken instructions.\n\nThis was found running the BPF selftests \"test_progs:\nuprobe_autoattach, attach_probe\" on the Spacemit K1/X60, where the\nuprobes tests randomly blew up."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - Exploitation requires local execution on the target \u2014 the attacker must run a process that executes the probed instruction and primes the I-cache at the user-mapped `[uprobes]` XOL page. There is no network-reachable path to `arch_uprobe_copy_ixol()`.\nAC:L - RISC-V has no implicit I$/D$ coherence, so the missing `fence.i` leaves stale lines as baseline architectural behavior, not a rare config; the attacker can trigger the XOL path repeatedly at will and can deliberately execute at the known, user-mapped XOL slot addresses to seed the stale lines. The bug was observed reproducing on stock hardware during ordinary selftest runs.\nPR:L - Once a uprobe is active \u2014 a routine observability configuration installed by an admin, not an attack step \u2014 an entirely unprivileged local user drives the vulnerable path just by calling the probed function in their own process. No capability is needed to reach `xol_get_insn_slot()` \u2192 `arch_uprobe_copy_ixol()`.\nUI:N - The attacker executes the probed instruction in its own process to trigger the XOL copy; no action by any other user or victim is required.\nS:U - The stale instruction executes in the traced process's own user context and the WARN/panic effects stay within the kernel's own authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The traced process \u2014 potentially a privileged daemon or setuid binary under a system-wide probe on libc/libssl \u2014 executes a stale instruction with its live register state, a control-flow-integrity failure that can branch into or read out that process's memory. The attacker influences what sits in the I-cache at that kernel-provided address.\nI:H - Executing a stale/wrong instruction with the probed process's live registers yields arbitrary stores and control-flow deviation inside that process, and the trailing ebreak may be skipped entirely, letting the PC run past the slot into adjacent slot contents.\nA:H - The probed process is killed via `force_sig(SIGILL)`, and the broken single-step contract hits `WARN_ON_ONCE` in both `arch_uprobe_post_xol()` and `handle_singlestep()`, which is a kernel panic under `panic_on_warn`. The commit reports uprobe selftests randomly blowing up on real hardware."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/riscv/kernel/probes/uprobes.c"], "versions": [{"version": "74784081aac8a0f3636965fc230e2d3b7cc123c6", "lessThan": "be6d98766ac952d38241d5a5b213f363afa421c3", "status": "affected", "versionType": "git"}, {"version": "74784081aac8a0f3636965fc230e2d3b7cc123c6", "lessThan": "b6d8d4d01ca8514fa89b05355f296758a91e2297", "status": "affected", "versionType": "git"}, {"version": "74784081aac8a0f3636965fc230e2d3b7cc123c6", "lessThan": "77c956152a3a7c7a18b68f3654f70565b2181d03", "status": "affected", "versionType": "git"}, {"version": "74784081aac8a0f3636965fc230e2d3b7cc123c6", "lessThan": "bcf6d3158c5902d92b6d62335af4422b7bf7c4e2", "status": "affected", "versionType": "git"}, {"version": "74784081aac8a0f3636965fc230e2d3b7cc123c6", "lessThan": "1dbb95a36499374c51b47ee8ae258a8862c20978", "status": "affected", "versionType": "git"}, {"version": "74784081aac8a0f3636965fc230e2d3b7cc123c6", "lessThan": "7d1d19a11cfbfd8bae1d89cc010b2cc397cd0c48", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/riscv/kernel/probes/uprobes.c"], "versions": [{"version": "5.12", "status": "affected"}, {"version": "0", "lessThan": "5.12", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.200", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.163", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.121", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.26", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.14.5", "lessThanOrEqual": "6.14.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.15", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "5.15.200"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.1.163"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.6.121"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.12.26"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.14.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.15"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/be6d98766ac952d38241d5a5b213f363afa421c3"}, {"url": "https://git.kernel.org/stable/c/b6d8d4d01ca8514fa89b05355f296758a91e2297"}, {"url": "https://git.kernel.org/stable/c/77c956152a3a7c7a18b68f3654f70565b2181d03"}, {"url": "https://git.kernel.org/stable/c/bcf6d3158c5902d92b6d62335af4422b7bf7c4e2"}, {"url": "https://git.kernel.org/stable/c/1dbb95a36499374c51b47ee8ae258a8862c20978"}, {"url": "https://git.kernel.org/stable/c/7d1d19a11cfbfd8bae1d89cc010b2cc397cd0c48"}], "title": "riscv: uprobes: Add missing fence.i after building the XOL buffer", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-37822", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:45:27.323225Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:52:01.328Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-37822", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:45:27.323225Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:45:28.135Z"}}], "cna": {"title": "riscv: uprobes: Add missing fence.i after building the XOL buffer", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - Exploitation requires local execution on the target \u2014 the attacker must run a process that executes the probed instruction and primes the I-cache at the user-mapped `[uprobes]` XOL page. There is no network-reachable path to `arch_uprobe_copy_ixol()`.\nAC:L - RISC-V has no implicit I$/D$ coherence, so the missing `fence.i` leaves stale lines as baseline architectural behavior, not a rare config; the attacker can trigger the XOL path repeatedly at will and can deliberately execute at the known, user-mapped XOL slot addresses to seed the stale lines. The bug was observed reproducing on stock hardware during ordinary selftest runs.\nPR:L - Once a uprobe is active \u2014 a routine observability configuration installed by an admin, not an attack step \u2014 an entirely unprivileged local user drives the vulnerable path just by calling the probed function in their own process. No capability is needed to reach `xol_get_insn_slot()` \u2192 `arch_uprobe_copy_ixol()`.\nUI:N - The attacker executes the probed instruction in its own process to trigger the XOL copy; no action by any other user or victim is required.\nS:U - The stale instruction executes in the traced process's own user context and the WARN/panic effects stay within the kernel's own authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The traced process \u2014 potentially a privileged daemon or setuid binary under a system-wide probe on libc/libssl \u2014 executes a stale instruction with its live register state, a control-flow-integrity failure that can branch into or read out that process's memory. The attacker influences what sits in the I-cache at that kernel-provided address.\nI:H - Executing a stale/wrong instruction with the probed process's live registers yields arbitrary stores and control-flow deviation inside that process, and the trailing ebreak may be skipped entirely, letting the PC run past the slot into adjacent slot contents.\nA:H - The probed process is killed via `force_sig(SIGILL)`, and the broken single-step contract hits `WARN_ON_ONCE` in both `arch_uprobe_post_xol()` and `handle_singlestep()`, which is a kernel panic under `panic_on_warn`. The commit reports uprobe selftests randomly blowing up on real hardware."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "74784081aac8a0f3636965fc230e2d3b7cc123c6", "lessThan": "be6d98766ac952d38241d5a5b213f363afa421c3", "versionType": "git"}, {"status": "affected", "version": "74784081aac8a0f3636965fc230e2d3b7cc123c6", "lessThan": "b6d8d4d01ca8514fa89b05355f296758a91e2297", "versionType": "git"}, {"status": "affected", "version": "74784081aac8a0f3636965fc230e2d3b7cc123c6", "lessThan": "77c956152a3a7c7a18b68f3654f70565b2181d03", "versionType": "git"}, {"status": "affected", "version": "74784081aac8a0f3636965fc230e2d3b7cc123c6", "lessThan": "bcf6d3158c5902d92b6d62335af4422b7bf7c4e2", "versionType": "git"}, {"status": "affected", "version": "74784081aac8a0f3636965fc230e2d3b7cc123c6", "lessThan": "1dbb95a36499374c51b47ee8ae258a8862c20978", "versionType": "git"}, {"status": "affected", "version": "74784081aac8a0f3636965fc230e2d3b7cc123c6", "lessThan": "7d1d19a11cfbfd8bae1d89cc010b2cc397cd0c48", "versionType": "git"}], "programFiles": ["arch/riscv/kernel/probes/uprobes.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.12"}, {"status": "unaffected", "version": "0", "lessThan": "5.12", "versionType": "semver"}, {"status": "unaffected", "version": "5.15.200", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.163", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.121", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.26", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.14.5", "versionType": "semver", "lessThanOrEqual": "6.14.*"}, {"status": "unaffected", "version": "6.15", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["arch/riscv/kernel/probes/uprobes.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/be6d98766ac952d38241d5a5b213f363afa421c3"}, {"url": "https://git.kernel.org/stable/c/b6d8d4d01ca8514fa89b05355f296758a91e2297"}, {"url": "https://git.kernel.org/stable/c/77c956152a3a7c7a18b68f3654f70565b2181d03"}, {"url": "https://git.kernel.org/stable/c/bcf6d3158c5902d92b6d62335af4422b7bf7c4e2"}, {"url": "https://git.kernel.org/stable/c/1dbb95a36499374c51b47ee8ae258a8862c20978"}, {"url": "https://git.kernel.org/stable/c/7d1d19a11cfbfd8bae1d89cc010b2cc397cd0c48"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: uprobes: Add missing fence.i after building the XOL buffer\n\nThe XOL (execute out-of-line) buffer is used to single-step the\nreplaced instruction(s) for uprobes. The RISC-V port was missing a\nproper fence.i (i$ flushing) after constructing the XOL buffer, which\ncan result in incorrect execution of stale/broken instructions.\n\nThis was found running the BPF selftests \"test_progs:\nuprobe_autoattach, attach_probe\" on the Spacemit K1/X60, where the\nuprobes tests randomly blew up."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.200", "versionStartIncluding": "5.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.163", "versionStartIncluding": "5.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.121", "versionStartIncluding": "5.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.26", "versionStartIncluding": "5.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.14.5", "versionStartIncluding": "5.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.15", "versionStartIncluding": "5.12"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:57:45.691Z"}}}, "cveMetadata": {"cveId": "CVE-2025-37822", "state": "PUBLISHED", "dateUpdated": "2026-10-15T21:52:01.328Z", "dateReserved": "2025-04-16T04:51:23.947Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-05-08T06:26:16.209Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["arch/riscv/kernel/probes/uprobes.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "be6d98766ac952d38241d5a5b213f363afa421c3", "status": "affected", "version": "74784081aac8a0f3636965fc230e2d3b7cc123c6", "versionType": "git"}, {"lessThan": "b6d8d4d01ca8514fa89b05355f296758a91e2297", "status": "affected", "version": "74784081aac8a0f3636965fc230e2d3b7cc123c6", "versionType": "git"}, {"lessThan": "77c956152a3a7c7a18b68f3654f70565b2181d03", "status": "affected", "version": "74784081aac8a0f3636965fc230e2d3b7cc123c6", "versionType": "git"}, {"lessThan": "bcf6d3158c5902d92b6d62335af4422b7bf7c4e2", "status": "affected", "version": "74784081aac8a0f3636965fc230e2d3b7cc123c6", "versionType": "git"}, {"lessThan": "1dbb95a36499374c51b47ee8ae258a8862c20978", "status": "affected", "version": "74784081aac8a0f3636965fc230e2d3b7cc123c6", "versionType": "git"}, {"lessThan": "7d1d19a11cfbfd8bae1d89cc010b2cc397cd0c48", "status": "affected", "version": "74784081aac8a0f3636965fc230e2d3b7cc123c6", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["arch/riscv/kernel/probes/uprobes.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.12"}, {"lessThan": "5.12", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.200", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.163", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.121", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.26", "versionType": "semver"}, {"lessThanOrEqual": "6.14.*", "status": "unaffected", "version": "6.14.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.15", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D3F18733-8BB0-4660-9A7D-24D2736EB26E", "versionEndExcluding": "6.12.26", "versionStartIncluding": "5.12", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6B25CA7E-4CD0-46DB-B4EF-13A3516071FB", "versionEndExcluding": "6.14.5", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*", "matchCriteriaId": "8D465631-2980-487A-8E65-40AE2B9F8ED1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*", "matchCriteriaId": "4C9D071F-B28E-46EC-AC61-22B913390211", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*", "matchCriteriaId": "13FC0DDE-E513-465E-9E81-515702D49B74", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: uprobes: Add missing fence.i after building the XOL buffer\n\nThe XOL (execute out-of-line) buffer is used to single-step the\nreplaced instruction(s) for uprobes. The RISC-V port was missing a\nproper fence.i (i$ flushing) after constructing the XOL buffer, which\ncan result in incorrect execution of stale/broken instructions.\n\nThis was found running the BPF selftests \"test_progs:\nuprobe_autoattach, attach_probe\" on the Spacemit K1/X60, where the\nuprobes tests randomly blew up."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: riscv: uprobes: A\u00f1adir un archivo \"fence.i\" faltante tras la construcci\u00f3n del b\u00fafer XOL. El b\u00fafer XOL (ejecuci\u00f3n fuera de l\u00ednea) se utiliza para ejecutar paso a paso las instrucciones reemplazadas para uprobes. El puerto RISC-V carec\u00eda de un archivo \"fence.i\" adecuado (vaciado de i$) tras la construcci\u00f3n del b\u00fafer XOL, lo que puede provocar la ejecuci\u00f3n incorrecta de instrucciones obsoletas o da\u00f1adas. Esto se detect\u00f3 al ejecutar las pruebas autom\u00e1ticas de BPF \"test_progs: uprobe_autoattach, attached_probe\" en Spacemit K1/X60, donde las pruebas de uprobes fallaron aleatoriamente."}], "id": "CVE-2025-37822", "lastModified": "2026-10-15T22:18:18.913", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-37822", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:45:27.323225Z", "version": "2.0.3"}}]}, "published": "2025-05-08T07:15:53.427", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1dbb95a36499374c51b47ee8ae258a8862c20978"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/77c956152a3a7c7a18b68f3654f70565b2181d03"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7d1d19a11cfbfd8bae1d89cc010b2cc397cd0c48"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b6d8d4d01ca8514fa89b05355f296758a91e2297"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/bcf6d3158c5902d92b6d62335af4422b7bf7c4e2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/be6d98766ac952d38241d5a5b213f363afa421c3"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: riscv: uprobes: Add missing fence.i after building the XOL buffer", "id": "2365027", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2365027"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nriscv: uprobes: Add missing fence.i after building the XOL buffer\nThe XOL (execute out-of-line) buffer is used to single-step the\nreplaced instruction(s) for uprobes. The RISC-V port was missing a\nproper fence.i (i$ flushing) after constructing the XOL buffer, which\ncan result in incorrect execution of stale/broken instructions.\nThis was found running the BPF selftests \"test_progs:\nuprobe_autoattach, attach_probe\" on the Spacemit K1/X60, where the\nuprobes tests randomly blew up."], "name": "CVE-2025-37822", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-05-08T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-37822\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-37822\nhttps://lore.kernel.org/linux-cve-announce/2025050821-CVE-2025-37822-9fef@gregkh/T"], "threat_severity": "Low"}

{}