CVE-2025-37991: 
Linux Kernel vulnerability analysis and mitigation

A vulnerability (CVE-2025-37991) was discovered in the Linux kernel affecting the parisc architecture, initially disclosed on May 20, 2025. The issue causes a SIGFPE exception to crash applications with a second SIGFPE in the signal handler (NVD, Wiz).

The vulnerability occurs because glibc uses a double-word floating-point store to atomically update function descriptors. During lazy binding, a floating-point store is encountered in fpe_func immediately. When the T bit is set, an assist exception trap occurs when the co-processor encounters any floating-point instruction except for a double store of register %fr0, which cancels all pending traps (NVD).

When exploited, this vulnerability results in application crashes with a second SIGFPE in the signal handler when the first SIGFPE exception occurs, leading to application instability and potential denial of service (Wiz).

The vulnerability has been addressed by clearing the Trap (T) bit in the FP status register before returning to the signal handler in userspace. For the Debian stable distribution (bookworm), these problems have been fixed in version 6.1.140-1 (Debian Security).