In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Don't override subprog's return value The verifier test `calls: div by 0 in subprog` triggers a panic at the ld.bu instruction. The ld.bu insn is trying to load byte from memory address returned by the subprog. The subprog actually set the correct address at the a5 register (dedicated register for BPF return values). But at commit 73c359d1d356 ("LoongArch: BPF: Sign-extend return values") we also sign extended a5 to the a0 register (return value in LoongArch). For function call insn, we later propagate the a0 register back to a5 register. This is right for native calls but wrong for bpf2bpf calls which expect zero-extended return value in a5 register. So only move a0 to a5 for native calls (i.e. non-BPF_PSEUDO_CALL).

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Don't override
    subprog's return value The verifier test `calls: div by 0 in subprog` triggers a panic at the ld.bu
    instruction. The ld.bu insn is trying to load byte from memory address returned by the subprog. The
    subprog actually set the correct address at the a5 register (dedicated register for BPF return values).
    But at commit 73c359d1d356 ("LoongArch: BPF: Sign-extend return values") we also sign extended a5 to the
    a0 register (return value in LoongArch). For function call insn, we later propagate the a0 register back
    to a5 register. This is right for native calls but wrong for bpf2bpf calls which expect zero-extended
    return value in a5 register. So only move a0 to a5 for native calls (i.e. non-BPF_PSEUDO_CALL).
    (CVE-2025-22048)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - LoongArch: BPF: Don't override subprog's return value The verifier test `calls: div by 0 in subprog`     triggers a panic at the ld.bu instruction. The ld.bu insn is trying to load byte from memory address     returned by the subprog. The subprog actually set the correct address at the a5 register (dedicated     register for BPF return values). But at commit 73c359d1d356 (LoongArch: BPF: Sign-extend return values)     we also sign extended a5 to the a0 register (return value in LoongArch). For function call insn, we later     propagate the a0 register back to a5 register. This is right for native calls but wrong for bpf2bpf calls     which expect zero-extended return value in a5 register. So only move a0 to a5 for native calls (i.e. non-     BPF_PSEUDO_CALL). (CVE-2025-22048)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
465933	Echo: linux: security update to 6.12.25-1	Tenable Cloud Security	Echo Local Security Checks	Local	medium
465933	Echo: linux: security update to 6.12.25-1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
243737	Linux Distros Unpatched Vulnerability : CVE-2025-22048	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2025-22048

medium

Tenable Plugins

medium

medium

medium