CVE-2025-37966: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-37966 is a vulnerability discovered in the Linux kernel affecting the RISC-V architecture, specifically related to the PRSETTAGGEDADDRCTRL functionality. The vulnerability was disclosed on May 20, 2025, and affects systems where the Supm extension is not available (NVD, RedHat).

The vulnerability manifests as a kernel crash when userspace attempts to execute PRSETTAGGEDADDRCTRL without the Supm extension being available. The crash presents as an illegal instruction error with specific error traces including 'epc: settaggedaddr_ctrl+0x112/0x15a' and other related stack traces. The vulnerability has been assigned a CVSS v3.1 score of 5.5 with a vector of CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (RedHat).

The vulnerability results in a kernel crash when triggered, affecting system availability. The impact is limited to RISC-V architecture systems where the Supm extension is not available, causing a denial of service condition through kernel crash (RedHat).

The vulnerability has been resolved by implementing a check for Supm availability before executing PRSETTAGGEDADDRCTRL operations. The fix involves verifying the presence of the Supm extension before proceeding with tagged address control operations (NVD).