LiveActive security incident?Get immediate response
CVE Record

CVE-2025-37929: arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays

In the Linux kernel, the following vulnerability has been resolved: arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays Commit a5951389e58d ("arm64: errata: Add newer ARM cores to the spectre_bhb_loop_affected() lists") added some additional CPUs to the Spectre-BHB workaround, including some new arrays for designs that require new 'k' values for the workaround to be effective. Unfortunately, the new arrays omitted the sentinel entry and so is_midr_in_range_list() will walk off the end when it doesn't find a match. With UBSAN enabled, this leads to a crash during boot when is_midr_in_range_list() is inlined (which was more common prior to c8c2647e69be ("arm64: Make  _midr_in_range_list() an exported function")): | Internal error: aarch64 BRK: 00000000f2000001 [#1] PREEMPT SMP | pstate: 804000c5 (Nzcv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) | pc : spectre_bhb_loop_affected+0x28/0x30 | lr : is_spectre_bhb_affected+0x170/0x190 | [...] | Call trace: | spectre_bhb_loop_affected+0x28/0x30 | update_cpu_capabilities+0xc0/0x184 | init_cpu_features+0x188/0x1a4 | cpuinfo_store_boot_cpu+0x4c/0x60 | smp_prepare_boot_cpu+0x38/0x54 | start_kernel+0x8c/0x478 | __primary_switched+0xc8/0xd4 | Code: 6b09011f 54000061 52801080 d65f03c0 (d4200020) | ---[ end trace 0000000000000000 ]--- | Kernel panic - not syncing: aarch64 BRK: Fatal exception Add the missing sentinel entries.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue affects some arm64 systems where a Spectre-BHB CPU workaround table was missing terminators. On non-matching CPUs, the kernel can read past the table and, with UBSAN enabled, panic during boot. The business concern is availability of affected ARM64 Linux hosts, not confirmed data theft or active exploitation.

Executive priority

Handle through normal-to-expedited kernel maintenance for ARM64 environments. Escalate if affected systems are used in production boot paths, appliances, CI runners, or fleets where a failed reboot creates service impact.

Technical view

The arm64 Spectre-BHB errata logic added MIDR range arrays for newer ARM cores but omitted sentinel entries. is_midr_in_range_list() can walk off the end when no match is found. The provided trace shows a boot-time kernel panic with UBSAN during CPU capability initialization. Stable kernel commits add the missing sentinel entries.

Likely exposure

Exposure appears limited to Linux arm64 kernels containing the referenced Spectre-BHB errata change, especially builds with UBSAN where the out-of-bounds walk can become a boot crash. The source bundle does not provide CPEs, a full affected version matrix, or cloud/provider-specific exposure details.

Exploitation context

The bundle marks KEV as false and provides no cited evidence of exploitation in the wild. The demonstrated failure mode is a boot-time crash during kernel initialization, not a remote attack path. Treat exploitability beyond that as unproven from the supplied evidence.

Researcher notes

The strongest evidence is the upstream kernel description and stable fix references. The source bundle lacks CVSS, CWE, CPEs, and detailed distro mapping. Avoid treating this as a Spectre data-leak exploit; the cited defect is a missing sentinel causing an out-of-bounds table walk and panic.

Mitigation direction

  • Update affected arm64 Linux kernels using vendor or Linux stable guidance.
  • Apply relevant Debian LTS kernel updates if using affected Debian packages.
  • Prioritize systems with UBSAN-enabled kernels or recent arm64 Spectre-BHB errata changes.
  • Monitor vendor advisories for exact affected and fixed package versions.

Validation and detection

  • Inventory Linux arm64 systems and kernel versions in production and test fleets.
  • Check whether kernels include the referenced Spectre-BHB errata change without the sentinel fix.
  • Review boot logs for Spectre-BHB initialization panics on affected ARM64 hardware.
  • Confirm deployed kernel packages include the stable fix or vendor backport.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-37929 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
1ADP providers
9Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux4a2f3d8260a996bc43dcc1ce49ac594db54f4b3e, 46e22de65eb45a67a68ddfe9301f79b0c3821ca8, a53b3599d9bf9375f9033f2aa1fa92714fb1d0f0, 4117975672c4743cffaf32b6fd018cfacd1b420e, 9ca4fe357464bbdad0db67985275f2694df8dab5, e060dbb7393ed7bdfba6b5ea7566f9ef87381cfb, a5951389e58d2e816eed3dbec5877de9327fd881, ed681e90fb244aa883b918c4d8be2614e816c6df, 6.13.12unaffected
LinuxLinux5.15.181, 6.1.135, 6.6.88, 6.12.24, 6.14.3unaffected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.