CVE-2025-38723

What it actually does

Incorrect jump offset calculation in LoongArch BPF tailcall emission due to skipped JIT context initialization on extra compile passes produces negative jmp_offset values, resulting in invalid branch targets and infinite loops within BPF programs.

Why it matters to the business

Systems running affected Linux kernels on LoongArch hardware can experience CPU soft lockups and watchdog-triggered hangs when BPF programs using tailcalls are executed, leading to service disruption and potential need for manual intervention or reboots.

How an attack unfolds

An attacker with local access loads a crafted BPF program containing tailcalls that triggers the offset miscalculation during JIT compilation; the resulting malformed assembly causes the kernel to repeatedly execute incorrect branches, inducing a soft lockup condition observable in dmesg.

How to fix it

Update to fixed kernel versions containing commit 1a782fa32e644aa9fbae6c8488f3e61221ac96e1 or equivalent stable patches; for MinimOS nodejs-24 packages upgrade to 24.4.1-r0 or later; rebuild and redeploy any affected BPF programs after kernel update.

How to confirm the fix worked

Verify kernel source contains the tailcall offset fix commit; re-run the selftest tailcalls/tailcall_bpf2bpf_1 and confirm absence of soft lockup messages in dmesg; check package versions match listed fixed releases.

Typical attack path

1. Obtain local unprivileged access on a LoongArch Linux system
2. Compile and load a BPF program that exercises tailcall paths via bpf() syscall
3. Trigger JIT compilation with multiple passes to skip offset calculation
4. Observe resulting negative jump offsets leading to CPU lockup

How to detect it

Search kernel logs and dmesg for watchdog soft lockup messages coinciding with BPF tailcall test execution or bpf program loads; correlate with process names involving test_progs or bpftool on LoongArch systems.

What your security team should do

• Prioritize kernel updates on all LoongArch production systems within standard patch windows
• Audit environments for use of BPF tailcalls and schedule test execution of affected selftests post-update
• Monitor EPSS trend and re-evaluate if new exploit code appears given current low score