CVE-2025-37966: riscv: Fix kernel crash due to PR_SET_TAGGED_ADDR_CTRL

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-05-20 · updated 2026-06-17

Description

In the Linux kernel, the following vulnerability has been resolved: riscv: Fix kernel crash due to PR_SET_TAGGED_ADDR_CTRL When userspace does PR_SET_TAGGED_ADDR_CTRL, but Supm extension is not available, the kernel crashes: Oops - illegal instruction [#1] [snip] epc : set_tagged_addr_ctrl+0x112/0x15a ra : set_tagged_addr_ctrl+0x74/0x15a epc : ffffffff80011ace ra : ffffffff80011a30 sp : ffffffc60039be10 [snip] status: 0000000200000120 badaddr: 0000000010a79073 cause: 0000000000000002 set_tagged_addr_ctrl+0x112/0x15a __riscv_sys_prctl+0x352/0x73c do_trap_ecall_u+0x17c/0x20c andle_exception+0x150/0x15c Fix it by checking if Supm is available.

Affected products

Linux kernel: from 6.13 before 6.14.7; 6.15-rc1, 6.15-rc2, 6.15-rc3, 6.15-rc4, 6.15-rc5 — fixed in 6.14.7

How to fix

Upgrade to a fixed version: Linux kernel 6.14.7. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-37966 or the next vulnerability affects your stack