arm64/fpsimd: Avoid clobbering kernel FPSIMD state with SMSTOP (Linux Linux)

CVE-2025-38169
HIGH 7.8

At a glance

Source
NVD
EPSS
EPSS 0.17 % · percentile 7 ()
State
PUBLISHED
Published
Updated
Assigner
Linux
NVD status
Modified

Description

In the Linux kernel, the following vulnerability has been resolved: arm64/fpsimd: Avoid clobbering kernel FPSIMD state with SMSTOP On system with SME, a thread's kernel FPSIMD state may be erroneously clobbered during a context switch immediately after that state is restored. Systems without SME are unaffected. If the CPU happens to be in streaming SVE mode before a context switch to a thread with kernel FPSIMD state, fpsimd_thread_switch() will restore the kernel FPSIMD state using fpsimd_load_kernel_state() while the CPU is still in streaming SVE mode. When fpsimd_thread_switch() subsequently calls fpsimd_flush_cpu_state(), this will execute an SMSTOP, causing an exit from streaming SVE mode. The exit from streaming SVE mode will cause the hardware to reset a number of FPSIMD/SVE/SME registers, clobbering the FPSIMD state. Fix this by calling fpsimd_flush_cpu_state() before restoring the kernel FPSIMD state.

References

Scores

VersionScoreVectorScored by
CVSS 3.1HIGH 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux
CVSS 3.1HIGH 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HNVD · 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Secondary)
CVSS 3.1MEDIUM 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD · nvd@nist.gov (Primary)

European references

CERT-FR advisories

Affected configurations (NVD CPE)

Affected products

ProductVersions
Linux · Linuxaffected e92bee9f861b466c676f0200be3e46af7bc4ac6b < 55d52af498daea75aa03ba9b7e444c8ae495ac20 ; affected e92bee9f861b466c676f0200be3e46af7bc4ac6b < a305821f597ec943849d3e53924adb88c61ed682 ; affected e92bee9f861b466c676f0200be3e46af7bc4ac6b < 01098d893fa8a6edb2b56e178b798e3e6b674f02 ; affected e003c485ac82a9f8de4204912ed059ac6dd4257c ; affected 25b90cd122d546823da90b916f7c3289dfe83a99 ; affected 6.8.12 < 6.9
Linux · Linuxaffected 6.10 ; unaffected 0 < 6.10 ; unaffected 6.12.34 ≤ 6.12.* ; unaffected 6.15.3 ≤ 6.15.* ; unaffected 6.16 ≤ *

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD