CVE-2025-38723

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

LoongArch: BPF: Fix jump offset calculation in tailcall

The extra pass of bpf_int_jit_compile() skips JIT context initialization

which essentially skips offset calculation leaving out_offset = -1, so

the jmp_offset in emit_bpf_tail_call is calculated by

"#define jmp_offset (out_offset - (cur_offset))"

is a negative number, which is wrong. The final generated assembly are

as follow.

54: bgeu $a2, $t1, -8 # 0x0000004c

58: addi.d $a6, $s5, -1

5c: bltz $a6, -16 # 0x0000004c

60: alsl.d $t2, $a2, $a1, 0x3

64: ld.d $t2, $t2, 264

68: beq $t2, $zero, -28 # 0x0000004c

Before apply this patch, the follow test case will reveal soft lock issues.

cd tools/testing/selftests/bpf/

./test_progs --allow=tailcalls/tailcall_bpf2bpf_1

dmesg:

watchdog: BUG: soft lockup - CPU#2 stuck for 26s! [test_progs:25056]

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References