CVE-2025-37948

What it actually does

A malicious classic cBPF program loaded via seccomp can manipulate the branch history buffer (BHB) on arm64 to influence speculative execution paths on BPF program exit, potentially enabling information disclosure.

Why it matters to the business

Systems running affected Ubuntu kernels on arm64 may be exposed to speculative execution side-channel leaks in seccomp-enforced environments; widespread presence across LTS releases increases patching urgency for cloud, container, and server fleets.

How an attack unfolds

An attacker loads a crafted cBPF seccomp filter that poisons branch history; on program exit the kernel epilogue fails to clear BHB state, allowing subsequent speculative execution to be steered toward kernel memory disclosure gadgets. Related campaigns have leveraged similar kernel privilege-escalation and information-disclosure primitives.

How to fix it

Upgrade to the fixed package versions provided by Ubuntu for each affected release (examples: linux 3.11.0-12.19 on 14.04, 4.4.0-2.16 on 16.04, 4.13.0-16.19 on 18.04, linux-aws-5.15 5.15.0-1073.79~20.04.1 on 20.04). Reboot after package installation.

How to confirm the fix worked

Verify running kernel version matches or exceeds the listed fixed package for the distribution release; confirm arm64 BHB mitigation sequence appears in cBPF epilogue via kernel disassembly or bpftool inspection on test systems.

Typical attack path

1. Identify arm64 Linux target using seccomp filters
2. Craft and load malicious classic cBPF program via seccomp
3. Trigger speculative execution on BPF exit by manipulating BHB
4. Observe side-channel leakage of kernel data

How to detect it

Examine system logs and audit records for unusual seccomp filter loads or BPF program activity around the time of suspected compromise; correlate with arm64 process execution that later exhibits speculative side-channel behavior.

What your security team should do

• Patch all arm64 Ubuntu systems to the listed fixed kernel versions immediately
• Prioritize workloads that rely on seccomp (containers, sandboxes)
• Monitor for new kernel updates in remaining LTS releases
• Review seccomp filter usage to reduce attack surface where possible