UnratedFix available
arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users
Type: advisorySources: OSV
In the Linux kernel, the following vulnerability has been resolved: arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users Support for eBPF programs loaded by unprivileged users is typically disabled. This means only cBPF programs need to be mitigated for BHB. In addition, only mitigate cBPF programs that were loaded by an unprivileged user. Privileged users can also load the same program via eBPF, making the mitigation pointless.
- Products
- Kernel
- Affected versions
- Not specified
- Fixed versions
- 5.10.239, 5.15.186, 6.1.139, 6.12.29, 6.14.7, 6.6.91
- CVEs
- CVE-2025-37963
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 02:04 UTC · Revision 1
Source evidence
arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users
core-osv · Original sourcePublished 20 May 2025, 16:01 UTC
In the Linux kernel, the following vulnerability has been resolved: arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users Support for eBPF programs loaded by unprivileged users is typically disabled. This means only cBPF programs need to be mitigated for BHB. In addition, only mitigate cBPF programs that were loaded by an unprivileged user. Privileged users can also load the same program via eBPF, making the mitigation pointless.
osv:CVE-2025-37963
Kernel
Fixed versions: 5.10.239, 5.15.186, 6.1.139, 6.6.91, 6.12.29, 6.14.7
Complete source record
{
"id": "359b6890faf333ab1263fc8412bdadccde99aedc59b4d50cf4e2f99952a573cb",
"url": "https://osv.dev/vulnerability/CVE-2025-37963",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users",
"summary": "In the Linux kernel, the following vulnerability has been resolved: arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users Support for eBPF programs loaded by unprivileged users is typically disabled. This means only cBPF programs need to be mitigated for BHB. In addition, only mitigate cBPF programs that were loaded by an unprivileged user. Privileged users can also load the same program via eBPF, making the mitigation pointless.",
"evidence": "osv:CVE-2025-37963",
"products": [
{
"name": {
"value": "Kernel",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "5.10.239",
"evidence": "/affected/1/ranges"
},
{
"value": "5.15.186",
"evidence": "/affected/1/ranges"
},
{
"value": "6.1.139",
"evidence": "/affected/1/ranges"
},
{
"value": "6.6.91",
"evidence": "/affected/1/ranges"
},
{
"value": "6.12.29",
"evidence": "/affected/1/ranges"
},
{
"value": "6.14.7",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "CVE-2025-37963",
"aliases": [
"CVE-2025-37963"
],
"affected": [
{
"ranges": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "0be7320a635c2e434e8b67e0e9474a85ceb421c4"
},
{
"fixed": "038866e01ea5e5a3d948898ac216e531e7848669"
},
{
"fixed": "df53d418709205450a02bb4d71cbfb4ff86f2c1e"
},
{
"fixed": "6e52d043f7dbf1839a24a3fab2b12b0d3839de7a"
},
{
"fixed": "80251f62028f1ab2e09be5ca3123f84e8b00389a"
},
{
"fixed": "e5f5100f1c64ac6c72671b2cf6b46542fce93706"
},
{
"fixed": "477481c4348268136227348984b6699d6370b685"
},
{
"fixed": "f300769ead032513a68e4a02e806393402e626f8"
}
]
}
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-37963.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.7.0"
},
{
"fixed": "5.10.239"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.11.0"
},
{
"fixed": "5.15.186"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.16.0"
},
{
"fixed": "6.1.139"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.2.0"
},
{
"fixed": "6.6.91"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.7.0"
},
{
"fixed": "6.12.29"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.13.0"
},
{
"fixed": "6.14.7"
}
]
}
],
"package": {
"name": "Kernel",
"ecosystem": "Linux"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-37963.json"
}
}
],
"modified": "2026-10-28T02:30:25.277488328Z",
"provider": "osv",
"references": [
"https://git.kernel.org/stable/c/038866e01ea5e5a3d948898ac216e531e7848669",
"https://git.kernel.org/stable/c/477481c4348268136227348984b6699d6370b685",
"https://git.kernel.org/stable/c/6e52d043f7dbf1839a24a3fab2b12b0d3839de7a",
"https://git.kernel.org/stable/c/80251f62028f1ab2e09be5ca3123f84e8b00389a",
"https://git.kernel.org/stable/c/df53d418709205450a02bb4d71cbfb4ff86f2c1e",
"https://git.kernel.org/stable/c/e5f5100f1c64ac6c72671b2cf6b46542fce93706",
"https://git.kernel.org/stable/c/f300769ead032513a68e4a02e806393402e626f8",
"https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html",
"https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/37xxx/CVE-2025-37963.json",
"https://nvd.nist.gov/vuln/detail/CVE-2025-37963",
"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
],
"provider_metadata": {
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/37xxx/CVE-2025-37963.json"
}
},
"related_cves": [
{
"value": "CVE-2025-37963",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 491774,
"published_at": "2025-05-20T16:01:55.322+00:00"
}