CVE-2025-37991: Linux Kernel Buffer Overflow Vulnerability

CVE-2025-37991 Overview

CVE-2025-37991 affects the Linux kernel on the PA-RISC (parisc) architecture. A floating-point exception (SIGFPE) delivered to a userspace process triggers a second SIGFPE inside the signal handler, terminating the application. The condition arises because the Trap (T) bit in the floating-point status register remains set when the kernel returns to userspace, causing the co-processor to raise another assist exception on the next floating-point instruction. The issue is triggered reliably by any signal handler that uses feenableexcept() and executes floating-point stores, which glibc performs during lazy binding of function descriptors.

Critical Impact
A local authenticated user can crash any application on PA-RISC systems that installs a SIGFPE handler, producing a denial-of-service condition on affected kernels.

Affected Products

Linux kernel on PA-RISC architecture (multiple stable branches including 6.15-rc1 through 6.15-rc4)
Debian Linux 11.0 (per Debian LTS advisory)
Downstream distributions shipping unpatched Linux kernel builds for parisc

Discovery Timeline

2025-05-20 - CVE-2025-37991 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-37991

Vulnerability Analysis

The defect resides in the PA-RISC floating-point exception delivery path of the Linux kernel. When a userspace program enables floating-point exceptions with feenableexcept(FE_OVERFLOW) and an overflow occurs, the kernel delivers SIGFPE to the process. Before returning to the registered signal handler, the kernel must reset the co-processor state so the handler itself does not immediately re-trap. The affected code fails to clear the Trap (T) bit in the FP status register, so the first floating-point instruction executed in the handler raises another assist exception. Because glibc uses double-word floating-point stores to atomically update lazy-binding function descriptors, the second trap fires almost immediately after handler entry. The result is process termination by SIGFPE.

Root Cause

The kernel path that prepares the signal frame on parisc leaves the FP status register T bit asserted. On PA-RISC, an assist exception trap occurs when the co-processor encounters any floating-point instruction except a double-store of register %fr0, which alone cancels pending traps. Any other floating-point op executed by the handler, including glibc's PLT lazy-binding stores, immediately re-traps. The kernel change resolves this by clearing the T bit before returning to userspace. Although catalogued under [CWE-415], the underlying condition is improper CPU state restoration during signal delivery rather than a memory-management double-free.

Attack Vector

Exploitation requires local access on a PA-RISC system running an unpatched kernel. A local user compiles and runs a program that registers a SIGFPE handler, enables floating-point overflow exceptions via feenableexcept(), and triggers an overflow. The kernel delivers the first SIGFPE, the handler entry executes floating-point instructions, and a second SIGFPE terminates the process. The reproducer published in the upstream commit message demonstrates the crash in fewer than 20 lines of C. There is no remote attack surface, and the impact is limited to denial of service against the target process on parisc hardware.

Detection Methods for CVE-2025-37991

Indicators of Compromise

Repeated process terminations logged as Floating point exception on parisc hosts running affected kernels
strace output showing two consecutive SIGFPE deliveries with si_code=FPE_FLTOVF followed by +++ killed by SIGFPE +++
Application crash reports from workloads that register SIGFPE handlers and use feenableexcept()

Detection Strategies

Inventory PA-RISC systems and correlate installed kernel versions against the fixed upstream commits listed in the kernel.org stable tree
Monitor dmesg and audit logs for recurring floating-point exception terminations on parisc build machines and CI runners
Compare running kernel build identifiers against the patched commit hashes such as ec4584495868 and df3592e493d7

Monitoring Recommendations

Ingest kernel and syslog telemetry from Linux endpoints into a centralized data lake and alert on abnormal rates of SIGFPE process terminations
Track kernel package versions across the fleet and flag parisc hosts that have not received the fixed stable release
Review scientific, compiler, and math-library workloads for unexpected crash loops following signal handler entry

How to Mitigate CVE-2025-37991

Immediate Actions Required

Update the Linux kernel on all PA-RISC systems to a stable release containing the fix referenced in the upstream commits
Apply Debian security updates for affected linux source packages as published in the Debian LTS announcement
Rebuild and redeploy custom kernels for parisc targets from a patched stable branch

Patch Information

The fix clears the Trap (T) bit in the FP status register before returning to the signal handler in userspace. Patched commits are available in the kernel.org stable tree, including ec4584495868, df3592e493d7, de3629baf5a3, and cf21e890f56b. Debian users should follow the Debian LTS Announcement for distribution-specific package versions.

Workarounds

Avoid enabling floating-point exception trapping with feenableexcept() in applications running on unpatched PA-RISC kernels
Restrict local shell and build access on affected parisc systems until the patched kernel is installed
If a kernel update is not immediately possible, isolate workloads that rely on SIGFPE handlers to already-patched hosts

bash

# Verify running kernel version and architecture before and after patching
uname -a
cat /proc/cpuinfo | grep -i parisc
# Debian: apply the security update once available
sudo apt-get update && sudo apt-get install --only-upgrade linux-image-parisc