{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2025-37822",
  "modified": "2026-10-09T11:39:44Z",
  "upstream": [
    "CVE-2025-37822"
  ],
  "published": "2025-05-08T06:39:36Z",
  "summary": "riscv: uprobes: Add missing fence.i after building the XOL buffer",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: uprobes: Add missing fence.i after building the XOL buffer\n\nThe XOL (execute out-of-line) buffer is used to single-step the\nreplaced instruction(s) for uprobes. The RISC-V port was missing a\nproper fence.i (i$ flushing) after constructing the XOL buffer, which\ncan result in incorrect execution of stale/broken instructions.\n\nThis was found running the BPF selftests \"test_progs:\nuprobe_autoattach, attach_probe\" on the Spacemit K1/X60, where the\nuprobes tests randomly blew up.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.163",
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-37822"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/be6d98766ac952d38241d5a5b213f363afa421c3"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/b6d8d4d01ca8514fa89b05355f296758a91e2297"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/77c956152a3a7c7a18b68f3654f70565b2181d03"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/bcf6d3158c5902d92b6d62335af4422b7bf7c4e2"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/1dbb95a36499374c51b47ee8ae258a8862c20978"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/7d1d19a11cfbfd8bae1d89cc010b2cc397cd0c48"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-08-05T12:19:11Z",
    "severity": {
      "source": "kernel CNA",
      "cvss_v3_score": 7.8,
      "cvss_v3_severity": "High",
      "scenario": "AV:L - Exploitation requires local execution on the target \u2014 the attacker must run a process that executes the probed instruction and primes the I-cache at the user-mapped `[uprobes]` XOL page. There is no network-reachable path to `arch_uprobe_copy_ixol()`.\nAC:L - RISC-V has no implicit I$/D$ coherence, so the missing `fence.i` leaves stale lines as baseline architectural behavior, not a rare config; the attacker can trigger the XOL path repeatedly at will and can deliberately execute at the known, user-mapped XOL slot addresses to seed the stale lines. The bug was observed reproducing on stock hardware during ordinary selftest runs.\nPR:L - Once a uprobe is active \u2014 a routine observability configuration installed by an admin, not an attack step \u2014 an entirely unprivileged local user drives the vulnerable path just by calling the probed function in their own process. No capability is needed to reach `xol_get_insn_slot()` \u2192 `arch_uprobe_copy_ixol()`.\nUI:N - The attacker executes the probed instruction in its own process to trigger the XOL copy; no action by any other user or victim is required.\nS:U - The stale instruction executes in the traced process's own user context and the WARN/panic effects stay within the kernel's own authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The traced process \u2014 potentially a privileged daemon or setuid binary under a system-wide probe on libc/libssl \u2014 executes a stale instruction with its live register state, a control-flow-integrity failure that can branch into or read out that process's memory. The attacker influences what sits in the I-cache at that kernel-provided address.\nI:H - Executing a stale/wrong instruction with the probed process's live registers yields arbitrary stores and control-flow deviation inside that process, and the trailing ebreak may be skipped entirely, letting the PC run past the slot into adjacent slot contents.\nA:H - The probed process is killed via `force_sig(SIGILL)`, and the broken single-step contract hits `WARN_ON_ONCE` in both `arch_uprobe_post_xol()` and `handle_singlestep()`, which is a kernel panic under `panic_on_warn`. The commit reports uprobe selftests randomly blowing up on real hardware."
    }
  }
}