Read the docs
TI-2025-25276 Aliases CVE-2025-37929GHSA-76f4-m3p8-6hm8

arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays

Priority LOW 24CWE-476Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-476.

Summary

In the Linux kernel, the following vulnerability has been resolved: arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays Commit a5951389e58d ("arm64: errata: Add newer ARM cores to the spectre_bhb_loop_affected() lists") added some additional CPUs to the Spectre-BHB workaround, including some new arrays for designs that require new 'k' values for the workaround to be effective. Unfortunately, the new arrays omitted the sentinel entry and so is_midr_in_range_list() will walk off the end when it doesn't find a match. With UBSAN enabled, this leads to a crash during boot when is_midr_in_range_list() is inlined (which was more common prior to c8c2647e69be ("arm64: Make  _midr_in_range_list() an exported function")): | Internal error: aarch64 BRK: 00000000f2000001 [#1] PREEMPT SMP | pstate: 804000c5 (Nzcv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) | pc : spectre_bhb_loop_affected+0x28/0x30 | lr : is_spectre_bhb_affected+0x170/0x190 | [...] | Call trace: | spectre_bhb_loop_affected+0x28/0x30 | update_cpu_capabilities+0xc0/0x184 | init_cpu_features+0x188/0x1a4 | cpuinfo_store_boot_cpu+0x4c/0x60 | smp_prepare_boot_cpu+0x38/0x54 | start_kernel+0x8c/0x478 | __primary_switched+0xc8/0xd4 | Code: 6b09011f 54000061 52801080 d65f03c0 (d4200020) | ---[ end trace 0000000000000000 ]--- | Kernel panic - not syncing: aarch64 BRK: Fatal exception Add the missing sentinel entries.

Why it matters now

EPSS 0.00204 10th percentileScored 2026-11-07
Fix Fixed Linux (Linux): 6.14, 5.15.182, 6.1.138 +3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
LinuxLinux6.13.12 to before 6.146.14Patch availableCNA
LinuxLinux5.15.181 to before 5.15.182; 6.1.135 to before 6.1.138; 6.6.88 to before 6.6.90; 6.12.24 to before 6.12.28; 6.14.3 to before 6.14.65.15.182, 6.1.138, 6.6.90, 6.12.28, 6.14.6Patch availableCNA
  • Linux VendorLinux Affected 6.13.12 to before 6.14 Fixed in 6.14 Patch available CNA
  • Linux VendorLinux Affected 5.15.181 to before 5.15.182; 6.1.135 to before 6.1.138; 6.6.88 to before 6.6.90; 6.12.24 to before 6.12.28; 6.14.3 to before 6.14.6 Fixed in 5.15.182, 6.1.138, 6.6.90, 6.12.28, 6.14.6 Patch available CNA

CPE configurations NVD · 7

CPEVersionsRoleVendor
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*6.1.135 to before 6.1.138; 6.6.88 to before 6.6.90; 6.12.24 to before 6.12.28; 6.13.12 to before 6.14; 6.14.3 to before 6.14.6VulnerableLinux
cpe:2.3:o:linux:linux_kernel:5.15.181:*:*:*:*:*:*:*5.15.181VulnerableLinux
cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*6.15 rc1VulnerableLinux
cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*6.15 rc2VulnerableLinux
cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*6.15 rc3VulnerableLinux
cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*6.15 rc4VulnerableLinux
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*11.0VulnerableDebian
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* Versions 6.1.135 to before 6.1.138; 6.6.88 to before 6.6.90; 6.12.24 to before 6.12.28; 6.13.12 to before 6.14; 6.14.3 to before 6.14.6 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:5.15.181:*:*:*:*:*:*:* Versions 5.15.181 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:* Versions 6.15 rc1 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:* Versions 6.15 rc2 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:* Versions 6.15 rc3 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:* Versions 6.15 rc4 Vulnerable ·Linux
  • cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian

Remediation

  • Fix · CNA Linux (Linux) Fixed in 6.14
  • Fix · CNA Linux (Linux) Fixed in 5.15.182, 6.1.138, 6.6.90, 6.12.28, 6.14.6

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 5 products
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-37929
  2. 2026-10-03 Alias added: GHSA-76f4-m3p8-6hm8

References

  • TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-38352 netfilter: bridge: make ebt_snat ARP rewrite writable KEVCVSS 3.1HIGH 8.8
  • TI-2013-05264 The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the… KEVCVSS 3.1HIGH 8.8
  • TI-2022-00125 Integer overflow in kernel KEVCVSS 3.1HIGH 8.4
  • TI-2013-01864 The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9… KEVCVSS 3.1HIGH 8.4
  • TI-2021-05514 Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE KEVCVSS 3.1HIGH 8.3
See all 15278 →

Sources