arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-476.
Summary
In the Linux kernel, the following vulnerability has been resolved: arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays Commit a5951389e58d ("arm64: errata: Add newer ARM cores to the spectre_bhb_loop_affected() lists") added some additional CPUs to the Spectre-BHB workaround, including some new arrays for designs that require new 'k' values for the workaround to be effective. Unfortunately, the new arrays omitted the sentinel entry and so is_midr_in_range_list() will walk off the end when it doesn't find a match. With UBSAN enabled, this leads to a crash during boot when is_midr_in_range_list() is inlined (which was more common prior to c8c2647e69be ("arm64: Make _midr_in_range_list() an exported function")): | Internal error: aarch64 BRK: 00000000f2000001 [#1] PREEMPT SMP | pstate: 804000c5 (Nzcv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) | pc : spectre_bhb_loop_affected+0x28/0x30 | lr : is_spectre_bhb_affected+0x170/0x190 | [...] | Call trace: | spectre_bhb_loop_affected+0x28/0x30 | update_cpu_capabilities+0xc0/0x184 | init_cpu_features+0x188/0x1a4 | cpuinfo_store_boot_cpu+0x4c/0x60 | smp_prepare_boot_cpu+0x38/0x54 | start_kernel+0x8c/0x478 | __primary_switched+0xc8/0xd4 | Code: 6b09011f 54000061 52801080 d65f03c0 (d4200020) | ---[ end trace 0000000000000000 ]--- | Kernel panic - not syncing: aarch64 BRK: Fatal exception Add the missing sentinel entries.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Linux | Linux | 6.13.12 to before 6.14 | 6.14 | Patch available | CNA |
| Linux | Linux | 5.15.181 to before 5.15.182; 6.1.135 to before 6.1.138; 6.6.88 to before 6.6.90; 6.12.24 to before 6.12.28; 6.14.3 to before 6.14.6 | 5.15.182, 6.1.138, 6.6.90, 6.12.28, 6.14.6 | Patch available | CNA |
- Linux VendorLinux Affected 6.13.12 to before 6.14 Fixed in 6.14 Patch available CNA
- Linux VendorLinux Affected 5.15.181 to before 5.15.182; 6.1.135 to before 6.1.138; 6.6.88 to before 6.6.90; 6.12.24 to before 6.12.28; 6.14.3 to before 6.14.6 Fixed in 5.15.182, 6.1.138, 6.6.90, 6.12.28, 6.14.6 Patch available CNA
CPE configurations NVD · 7
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.1.135 to before 6.1.138; 6.6.88 to before 6.6.90; 6.12.24 to before 6.12.28; 6.13.12 to before 6.14; 6.14.3 to before 6.14.6 | Vulnerable | Linux |
| cpe:2.3:o:linux:linux_kernel:5.15.181:*:*:*:*:*:*:* | 5.15.181 | Vulnerable | Linux |
| cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:* | 6.15 rc1 | Vulnerable | Linux |
| cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:* | 6.15 rc2 | Vulnerable | Linux |
| cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:* | 6.15 rc3 | Vulnerable | Linux |
| cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:* | 6.15 rc4 | Vulnerable | Linux |
| cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* | 11.0 | Vulnerable | Debian |
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* Versions 6.1.135 to before 6.1.138; 6.6.88 to before 6.6.90; 6.12.24 to before 6.12.28; 6.13.12 to before 6.14; 6.14.3 to before 6.14.6 Vulnerable ·Linux
- cpe:2.3:o:linux:linux_kernel:5.15.181:*:*:*:*:*:*:* Versions 5.15.181 Vulnerable ·Linux
- cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:* Versions 6.15 rc1 Vulnerable ·Linux
- cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:* Versions 6.15 rc2 Vulnerable ·Linux
- cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:* Versions 6.15 rc3 Vulnerable ·Linux
- cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:* Versions 6.15 rc4 Vulnerable ·Linux
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian
Remediation
- Fix · CNA Linux (Linux) Fixed in 6.14
- Fix · CNA Linux (Linux) Fixed in 5.15.182, 6.1.138, 6.6.90, 6.12.28, 6.14.6
Vendor assessments
Red Hat
Not affected: 5 products
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
Timeline
- 2026-10-02 Threatist record created from CVE-2025-37929
- 2026-10-03 Alias added: GHSA-76f4-m3p8-6hm8
References
Patch 7
- https://git.kernel.org/stable/c/e68da90ac00d8b681561aeb8f5d6c47af3a04861
- https://git.kernel.org/stable/c/6266b3509b2c6ebf2f9daf2239ff8eb60c5f5bd3
- https://git.kernel.org/stable/c/446289b8b36b2ee98dabf6388acbddcc33ed41be
- https://git.kernel.org/stable/c/3821cae9bd5a99a42d3d0be1b58e41f072cd4c4c
- https://git.kernel.org/stable/c/090c8714efe1c3c470301cc2f794c1ee2a57746c
- https://git.kernel.org/stable/c/333579202f09e260e8116321df4c55f80a19b160
- https://git.kernel.org/stable/c/fee4d171451c1ad9e8aaf65fc0ab7d143a33bd72
More Linux Kernel vulnerabilities
- TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
- TI-2026-38352 netfilter: bridge: make ebt_snat ARP rewrite writable KEVCVSS 3.1HIGH 8.8
- TI-2013-05264 The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the… KEVCVSS 3.1HIGH 8.8
- TI-2022-00125 Integer overflow in kernel KEVCVSS 3.1HIGH 8.4
- TI-2013-01864 The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9… KEVCVSS 3.1HIGH 8.4
- TI-2021-05514 Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE KEVCVSS 3.1HIGH 8.3
Sources
- CVE-2025-37929 · CVE Program
- CVE-2025-37929 · NVD
- FIRST EPSS
- GHSA-76f4-m3p8-6hm8 · GitHub Advisory Database · CC BY 4.0
- CVE-2025-37929 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences