Double SIGFPE Crash in Linux Kernel on parisc Architecture
Summary
CVE-2025-37991: In the Linux kernel, the following vulnerability has been resolved: parisc: Fix double SIGFPE crash Camm noticed that on parisc a SIGFPE exception will crash an application with a second SIGFPE in the signal handler. Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing system resources and facilitating communication between hardware and software. It supports a wide range of architectures, including parisc, which is used in some HP servers. This vulnerability affects the handling of floating-point exceptions, specifically SIGFPE, leading to potential application crashes.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified that causes a double SIGFPE (Floating Point Exception) crash on the parisc architecture. This issue arises when a SIGFPE exception occurs, triggering a second SIGFPE in the signal handler due to the way glibc manages function descriptors. The problem is exacerbated by lazy binding, which leads to a floating-point store operation that causes an assist exception trap when the T bit is set in the FP status register. This results in applications crashing unexpectedly, which can lead to data loss and system instability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can modify their signal handling code to ensure that the Trap (T) bit in the FP status register is cleared before returning to the signal handler in userspace. Below is a sample code snippet that demonstrates how to handle SIGFPE safely:
#include <stdio.h> #include <signal.h> #include <fenv.h>
static void fpe_func(int sig, siginfo_t *i, void *v) { sigset_t set;
sigemptyset(&set);
sigaddset(&set, SIGFPE);
sigprocmask(SIG_UNBLOCK, &set, NULL);
printf("GOT signal %d with si_code %ld\n", sig, i->si_code);
}
int main() { struct sigaction action = { .sa_sigaction = fpe_func, .sa_flags = SA_RESTART | SA_SIGINFO
};
sigaction(SIGFPE, &action, 0);
feenableexcept(FE_OVERFLOW);
return printf("%lf\n", 1.7976931348623158E308 * 1.7976931348623158E308);
}
Conclusion
The vulnerability CVE-2025-37991 in the Linux kernel affects the parisc architecture, leading to potential crashes due to double SIGFPE exceptions. Users are advised to update their kernel to the latest patched version to mitigate this risk. Temporary workarounds can be implemented in the signal handling code to improve stability until an update can be applied.
See every vulnerability recorded for linux →
FAQ
SIGFPE is a signal sent to a process when it performs an erroneous arithmetic operation, such as division by zero or an overflow in floating-point calculations.
You can use tools like Vulert, which monitors open-source vulnerabilities in your software using a manifest file. Visit Vulert Scanner to check your application without needing to sign up.
The vulnerability can lead to application crashes, data loss, and system instability, particularly for applications that rely heavily on floating-point calculations.
Yes, users should update to the latest version of the Linux kernel available for their Debian distribution to ensure that the vulnerability is patched.
If an immediate update is not possible, consider implementing the provided workaround to handle SIGFPE exceptions more safely in your applications.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
