CVE-2025-37963

What it actually does

The Linux kernel on arm64 previously applied BHB mitigation to all cBPF programs instead of restricting it to those loaded by unprivileged users, creating an unnecessary but incomplete side-channel barrier that could allow information disclosure via branch history buffer speculation.

Why it matters to the business

On arm64 Linux systems, unprivileged users able to load cBPF programs could potentially extract sensitive kernel data through side-channel attacks, raising exposure in shared or containerized environments; low EPSS and absence from KEV indicate limited real-world urgency despite mentions alongside other Linux privilege-escalation campaigns.

How an attack unfolds

An attacker with unprivileged access loads a crafted cBPF program on an arm64 system, then leverages the incomplete BHB mitigation to perform speculative execution side-channel reads that disclose kernel memory contents, consistent with patterns seen in Advanced Spyware Campaign and related Linux kernel privilege-escalation activity.

How to fix it

Upgrade the Linux kernel to the fixed commit 038866e01ea5e5a3d948898ac216e531e7848669 or later stable release containing this change; restrict unprivileged BPF loading via kernel configuration where possible.

How to confirm the fix worked

Verify the running kernel contains commit 038866e01ea5e5a3d948898ac216e531e7848669 via git log or uname output; confirm mitigation logic only targets unprivileged cBPF loads through source inspection or kernel debug flags.

Typical attack path

1. Gain unprivileged shell or container access on arm64 Linux
2. Load malicious cBPF program via unprivileged interface
3. Trigger BHB speculation side-channel to read kernel memory
4. Exfiltrate disclosed information

How to detect it

Review kernel audit logs and BPF event traces for cBPF program loads by non-root users; correlate with arm64-specific speculative execution warnings or unusual memory access patterns reported in security monitoring.

What your security team should do

• Apply the referenced kernel commit to all arm64 production systems within standard patch windows
• Audit systems for unprivileged BPF loading capability and disable where unnecessary
• Monitor EPSS trend and threat actor mentions for any increase in exploitation attempts