CVE-2025-37991 is a vulnerability identified in the Linux kernel specifically affecting the PA-RISC (parisc) architecture. The issue arises from improper handling of floating-point exceptions (SIGFPE) within signal handlers. On parisc systems, when a SIGFPE exception occurs, the kernel may crash an application with a second SIGFPE triggered inside the signal handler itself. This behavior is due to the way glibc performs atomic updates of function descriptors using double-word floating-point stores, which interacts poorly with the floating-point exception handling mechanism on parisc. The root cause is that the Trap (T) bit in the floating-point status register remains set when returning to user space, causing the co-processor to generate an assist exception trap on any floating-point instruction except a double store of register %fr0. This leads to a cascading failure where the signal handler triggers another SIGFPE, resulting in application termination. The vulnerability can be reproduced with a test program that installs a SIGFPE handler and triggers a floating-point overflow exception. The fix involves clearing the Trap (T) bit in the floating-point status register before returning to the signal handler in user space, preventing the second SIGFPE from occurring. This vulnerability is architecture-specific and affects Linux kernel versions containing the identified commit hashes. There are no known exploits in the wild, and no CVSS score has been assigned yet.

For European organizations, the impact of CVE-2025-37991 is primarily relevant to those running Linux on PA-RISC hardware, which is a niche architecture with limited deployment in modern enterprise environments. However, organizations that maintain legacy systems or specialized industrial or scientific equipment using PA-RISC Linux could experience application crashes due to unhandled floating-point exceptions, potentially leading to service disruptions or data processing failures. The vulnerability affects application availability and stability rather than confidentiality or integrity directly. Since the issue triggers a fatal signal in user applications, it could be exploited to cause denial of service conditions in critical systems relying on floating-point computations. The lack of known exploits and the architecture specificity reduce the immediate risk, but organizations with PA-RISC Linux systems should prioritize patching to avoid unexpected application crashes and maintain operational continuity.

1. Apply the official Linux kernel patch that clears the Trap (T) bit in the floating-point status register before returning to user space signal handlers on PA-RISC systems. This is the definitive fix for the issue. 2. For organizations unable to immediately patch, consider disabling or limiting the use of floating-point exception handling (SIGFPE) in critical applications to reduce the risk of triggering the vulnerability. 3. Conduct thorough testing of applications that use floating-point operations and signal handlers on PA-RISC Linux systems to identify potential crash scenarios. 4. Monitor system logs for repeated SIGFPE signals or application crashes that could indicate attempts to trigger this vulnerability. 5. Maintain an inventory of PA-RISC Linux systems and assess their criticality to prioritize patch deployment. 6. Engage with Linux distribution vendors or maintainers to ensure timely updates and backports of the fix for affected kernel versions.