Critical Spectre-BHB Vulnerability in Linux Kernel Affecting Debian Packages
Summary
CVE-2025-37929: In the Linux kernel, the following vulnerability has been resolved: arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays Commit a5951389e58d ("arm64: errata: Add newer ARM cores to the spectre_bhb_loop_affecte... Affects linux versions < 6.1.140-1. Fixed in 6.1.140-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to applications. It is widely used in various distributions, including Debian. The kernel's stability and security are paramount, as vulnerabilities can lead to system crashes, data breaches, and exploitation by malicious actors. The recent vulnerability identified as CVE-2025-37929 affects specific ARM64 architectures, highlighting the importance of maintaining up-to-date kernel versions.
Vulnerability Detail
CVE-2025-37929 is a vulnerability in the Linux kernel that arises from the omission of sentinel entries in the Spectre-BHB MIDR arrays. This oversight can cause the function is_midr_in_range_list() to walk off the end of the array, leading to a kernel panic during boot when Undefined Behavior Sanitizer (UBSAN) is enabled. The crash manifests as an internal error, resulting in a fatal exception that halts the system. This vulnerability primarily affects ARM64 architectures and can severely disrupt system operations.
How To Fix
Minimum fixed version
6.1.140-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability other than applying the patch. Users are advised to monitor their systems and apply updates as soon as they are available.
Conclusion
CVE-2025-37929 represents a significant vulnerability in the Linux kernel that can lead to system instability on affected ARM64 architectures. It is crucial for users to update their systems to the patched version of the kernel to mitigate this risk. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
CVE-2025-37929 is a vulnerability in the Linux kernel that affects ARM64 architectures, leading to potential system crashes during boot due to an array handling error.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json, you can check for vulnerabilities without needing to install any software.
The vulnerability can lead to kernel panics, causing the system to crash during boot, which can disrupt operations and lead to data loss.
Yes, a patch has been released that adds the missing sentinel entries to the Spectre-BHB MIDR arrays. Users should update their Linux kernel to the latest version to apply the fix.
You can use tools like Vulert to receive real-time alerts for open-source vulnerabilities in your software, ensuring you are always informed about potential risks.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
