CVE-2025-22048
- Source
- https://cve.org/CVERecord?id=CVE-2025-22048
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-22048.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2025-22048
- Downstream
BELL (1)
DEBIAN (1)
ECHO (1)
MGASA (2)
MINI (1)
OESA (2)
ROOT (1)
UBUNTU (1)
- Published
- 2025-04-16T14:12:07Z
- Modified
- 2026-10-20T11:08:00Z
- Severity
-
- 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- LoongArch: BPF: Don't override subprog's return value
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
LoongArch: BPF: Don't override subprog's return value
The verifier test
calls: div by 0 in subprogtriggers a panic at the ld.bu instruction. The ld.bu insn is trying to load byte from memory address returned by the subprog. The subprog actually set the correct address at the a5 register (dedicated register for BPF return values). But at commit 73c359d1d356 ("LoongArch: BPF: Sign-extend return values") we also sign extended a5 to the a0 register (return value in LoongArch). For function call insn, we later propagate the a0 register back to a5 register. This is right for native calls but wrong for bpf2bpf calls which expect zero-extended return value in a5 register. So only move a0 to a5 for native calls (i.e. non-BPF_PSEUDO_CALL). - Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/22xxx/CVE-2025-22048.json" }- References
-
- https://git.kernel.org/stable/c/223d565d8892481684091cfbaf3466f2b0e289d3
- https://git.kernel.org/stable/c/60f3caff1492e5b8616b9578c4bedb5c0a88ed14
- https://git.kernel.org/stable/c/780628a780b622759d9e5adc76d15432144da1a3
- https://git.kernel.org/stable/c/7df2696256a034405d3c5a71b3a4c54725de4404
- https://git.kernel.org/stable/c/996e90ab446641553e8e21707b38b9709605e0e0
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/22xxx/CVE-2025-22048.json
- https://nvd.nist.gov/vuln/detail/CVE-2025-22048
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced0c8d50501bc13cacecc19caaddc10db372592a39Fixed7df2696256a034405d3c5a71b3a4c54725de4404
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedd5d83242a1d778ceb6d8b07c6b491cf7483ca112Fixed223d565d8892481684091cfbaf3466f2b0e289d3
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced73c359d1d356cf10236ccd358bd55edab33e9424Fixed780628a780b622759d9e5adc76d15432144da1a3Fixed996e90ab446641553e8e21707b38b9709605e0e0Fixed60f3caff1492e5b8616b9578c4bedb5c0a88ed14
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced6.6.64Fixed6.6.87
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced6.12.2Fixed6.12.23
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced6.1.120Fixed6.2
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced6.11.11Fixed6.12
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced8382e92f90b601acf6d426121e6f4991502e767d
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced3b75f627b73d96787a493e2f1187543ba9c056a4
Affected versions
v6.*
v6.1.120
v6.1.121
v6.1.122
v6.1.123
v6.1.124
v6.1.125
v6.1.126
v6.1.127
v6.1.128
v6.1.129
v6.1.130
v6.1.131
v6.1.132
v6.1.133
v6.1.134
v6.1.135
v6.1.136
v6.1.137
v6.1.138
v6.1.139
v6.1.140
v6.1.141
v6.1.142
v6.1.143
v6.1.144
v6.1.145
v6.1.146
v6.1.147
v6.1.148
v6.1.149
v6.1.150
v6.1.151
v6.1.152
v6.1.153
v6.1.154
v6.1.155
v6.1.156
v6.1.157
v6.1.158
v6.1.159
v6.1.160
v6.1.161
v6.1.162
v6.1.163
v6.1.164
v6.1.165
v6.1.166
v6.1.167
v6.1.168
v6.1.169
v6.1.170
v6.1.171
v6.1.172
v6.1.173
v6.1.174
v6.1.175
v6.1.176
v6.1.177
v6.1.178
v6.1.179
v6.1.180
v6.1.181
v6.1.182
v6.1.183
v6.1.184
v6.1.185
v6.1.186
v6.1.187
v6.1.188
v6.1.189
v6.1.190
v6.11.11
v6.12.10
v6.12.11
v6.12.12
v6.12.13
v6.12.14
v6.12.15
v6.12.16
v6.12.17
v6.12.18
v6.12.19
v6.12.2
v6.12.20
v6.12.21
v6.12.22
v6.12.3
v6.12.4
v6.12.5
v6.12.6
v6.12.7
v6.12.8
v6.12.9
v6.6.64
v6.6.65
v6.6.66
v6.6.67
v6.6.68
v6.6.69
v6.6.70
v6.6.71
v6.6.72
v6.6.73
v6.6.74
v6.6.75
v6.6.76
v6.6.77
v6.6.78
v6.6.79
v6.6.80
v6.6.81
v6.6.82
v6.6.83
v6.6.84
v6.6.85
v6.6.86