CVE-2025-38723 – LoongArch: BPF: Fix jump offset calculation in tailcall

CVE ID : CVE-2025-38723

Published : Sept. 4, 2025, 4:15 p.m. | 56 minutes ago

Description : In the Linux kernel, the following vulnerability has been resolved:

LoongArch: BPF: Fix jump offset calculation in tailcall

The extra pass of bpf_int_jit_compile() skips JIT context initialization
which essentially skips offset calculation leaving out_offset = -1, so
the jmp_offset in emit_bpf_tail_call is calculated by

“#define jmp_offset (out_offset – (cur_offset))”

is a negative number, which is wrong. The final generated assembly are
as follow.

54: bgeu $a2, $t1, -8 # 0x0000004c
58: addi.d $a6, $s5, -1
5c: bltz $a6, -16 # 0x0000004c
60: alsl.d $t2, $a2, $a1, 0x3
64: ld.d $t2, $t2, 264
68: beq $t2, $zero, -28 # 0x0000004c

Before apply this patch, the follow test case will reveal soft lock issues.

cd tools/testing/selftests/bpf/
./test_progs –allow=tailcalls/tailcall_bpf2bpf_1

dmesg:
watchdog: BUG: soft lockup – CPU#2 stuck for 26s! [test_progs:25056]
Severity: 0.0 | NA

Visit the link for more details, such as CVSS details, affected products, timeline, and more…