CVE-2025-37948: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-37948 is a vulnerability discovered in the Linux kernel's arm64 BPF (Berkeley Packet Filter) implementation, disclosed on May 20, 2025. The vulnerability specifically affects 'classic' cBPF programs that are loaded through the seccomp system (NVD, Wiz).

The vulnerability stems from a security weakness where a malicious BPF program can manipulate the branch history to influence hardware speculation behavior. The issue specifically relates to the epilogue of cBPF programs, requiring the implementation of BHB (Branch History Buffer) mitigation sequences upon program exit (Wiz).

When exploited, this vulnerability could allow an attacker to manipulate branch prediction behavior, potentially leading to speculative execution attacks. The impact is specifically focused on the arm64 architecture where branch history manipulation could influence the system's speculative execution patterns (Wiz).

The vulnerability has been resolved through the implementation of BHB mitigation sequences in the epilogue for cBPF programs. This mitigation is specifically applied to 'classic' cBPF programs that are loaded by seccomp (NVD, Wiz).