CVE-2025-37991 — parisc: Fix double SIGFPE crash

Affected: Linux

In the Linux kernel, the following vulnerability has been resolved:

parisc: Fix double SIGFPE crash

Camm noticed that on parisc a SIGFPE exception will crash an application with a second SIGFPE in the signal handler. Dave analyzed it, and it happens because glibc uses a double-word floating-point store to atomically update function descriptors. As a result of lazy binding, we hit a floating-point store in fpe_func almost immediately.

When the T bit is set, an assist exception trap occurs when when the co-processor encounters *any* floating-point instruction except for a double store of register %fr0. The latter cancels all pending traps. Let's fix this by clearing the Trap (T) bit in the FP status register before returning to the signal handler in userspace.

The issue can be reproduced with this test program:

root@parisc:~# cat fpe.c

static void fpe_func(int sig, siginfo_t *i, void *v) { sigset_t set; sigemptyset(&set); sigaddset(&set, SIGFPE); sigprocmask(SIG_UNBLOCK, &set, NULL); printf("GOT signal %d with si_code %ld\n", sig, i->si_code); }

int main() { struct sigaction action = { .sa_sigaction = fpe_func, .sa_flags = SA_RESTART|SA_SIGINFO }; sigaction(SIGFPE, &action, 0); feenableexcept(FE_OVERFLOW); return printf("%lf\n",1.7976931348623158E308*1.7976931348623158E308); }

root@parisc:~# gcc fpe.c -lm root@parisc:~# ./a.out Floating point exception

root@pari…

USN-7649-1 — linux, linux-gcp, linux-raspi, linux-realtime vulnerabilities

Affected: Ubuntu:25.04: linux, Ubuntu:25.04: linux-gcp, Ubuntu:25.04: linux-raspi, Ubuntu:25.04: linux-realtime

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - PA-RISC architecture; - PowerPC architecture; - S390 architecture; - x86 architecture; - Compute Acceleration Framework; - Ublk userspace block driver; - Bluetooth drivers; - ARM SCMI message protocol; - GPU drivers; - IOMMU subsystem; - IRQ chip drivers; - Multiple devices driver; - Network drivers; - PCI subsystem; - PTP clock framework; - SPI subsystem; - BTRFS file system; - SMB network file system; - eXpress Data Path; - Universal MIDI packet (UMP) support module; - Tracing infrastructure; - Memory management; - IPv4 networking; - IPv6 networking; - Network traffic control; - AMD SoC Alsa drivers; - SoC Audio generic drivers; (CVE-2025-37898, CVE-2025-37990, CVE-2025-37974, CVE-2025-37991, CVE-2025-37894, CVE-2025-37906, CVE-2025-37896, CVE-2025-37909, CVE-2025-37923, CVE-2025-37899, CVE-2025-37901, CVE-2025-37914, CVE-2025-38216, CVE-2025-37931, CVE-2025-37928, CVE-2025-37916, CVE-2025-37908, CVE-2025-37915, CVE-2025-37917, CVE-2025-37921, CVE-2025-37903, CVE-2025-37922, CVE-2025-37895, CVE-2025-37936, CVE-2025-37933, CVE-2025-37891, CVE-2025-37926, CVE-2025-37912, CVE-2025-37920, CVE-2025-37924, CVE-2025-37927, CVE-2025-37946, CVE-2025-37907, CVE-2025-37930, CVE-2025-37911, CVE-2025-37905, CVE-2025-37900, CVE-202…

Most recent entries from all

CVE-2025-37991 — parisc: Fix double SIGFPE crash

USN-7649-1 — linux, linux-gcp, linux-raspi, linux-realtime vulnerabilities