CVE-2025-38169 (GCVE-0-2025-38169)
Vulnerability from cvelistv5
Published
2025-07-03 08:36
Modified
2025-07-28 04:14
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: arm64/fpsimd: Avoid clobbering kernel FPSIMD state with SMSTOP On system with SME, a thread's kernel FPSIMD state may be erroneously clobbered during a context switch immediately after that state is restored. Systems without SME are unaffected. If the CPU happens to be in streaming SVE mode before a context switch to a thread with kernel FPSIMD state, fpsimd_thread_switch() will restore the kernel FPSIMD state using fpsimd_load_kernel_state() while the CPU is still in streaming SVE mode. When fpsimd_thread_switch() subsequently calls fpsimd_flush_cpu_state(), this will execute an SMSTOP, causing an exit from streaming SVE mode. The exit from streaming SVE mode will cause the hardware to reset a number of FPSIMD/SVE/SME registers, clobbering the FPSIMD state. Fix this by calling fpsimd_flush_cpu_state() before restoring the kernel FPSIMD state.
References
Impacted products
Vendor Product Version
Linux Linux Version: e92bee9f861b466c676f0200be3e46af7bc4ac6b
Version: e92bee9f861b466c676f0200be3e46af7bc4ac6b
Version: e92bee9f861b466c676f0200be3e46af7bc4ac6b
Version: e003c485ac82a9f8de4204912ed059ac6dd4257c
Version: 25b90cd122d546823da90b916f7c3289dfe83a99
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/kernel/fpsimd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "55d52af498daea75aa03ba9b7e444c8ae495ac20",
              "status": "affected",
              "version": "e92bee9f861b466c676f0200be3e46af7bc4ac6b",
              "versionType": "git"
            },
            {
              "lessThan": "a305821f597ec943849d3e53924adb88c61ed682",
              "status": "affected",
              "version": "e92bee9f861b466c676f0200be3e46af7bc4ac6b",
              "versionType": "git"
            },
            {
              "lessThan": "01098d893fa8a6edb2b56e178b798e3e6b674f02",
              "status": "affected",
              "version": "e92bee9f861b466c676f0200be3e46af7bc4ac6b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e003c485ac82a9f8de4204912ed059ac6dd4257c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "25b90cd122d546823da90b916f7c3289dfe83a99",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/kernel/fpsimd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.34",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.3",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.8.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.9.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64/fpsimd: Avoid clobbering kernel FPSIMD state with SMSTOP\n\nOn system with SME, a thread\u0027s kernel FPSIMD state may be erroneously\nclobbered during a context switch immediately after that state is\nrestored. Systems without SME are unaffected.\n\nIf the CPU happens to be in streaming SVE mode before a context switch\nto a thread with kernel FPSIMD state, fpsimd_thread_switch() will\nrestore the kernel FPSIMD state using fpsimd_load_kernel_state() while\nthe CPU is still in streaming SVE mode. When fpsimd_thread_switch()\nsubsequently calls fpsimd_flush_cpu_state(), this will execute an\nSMSTOP, causing an exit from streaming SVE mode. The exit from\nstreaming SVE mode will cause the hardware to reset a number of\nFPSIMD/SVE/SME registers, clobbering the FPSIMD state.\n\nFix this by calling fpsimd_flush_cpu_state() before restoring the kernel\nFPSIMD state."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-28T04:14:09.744Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/55d52af498daea75aa03ba9b7e444c8ae495ac20"
        },
        {
          "url": "https://git.kernel.org/stable/c/a305821f597ec943849d3e53924adb88c61ed682"
        },
        {
          "url": "https://git.kernel.org/stable/c/01098d893fa8a6edb2b56e178b798e3e6b674f02"
        }
      ],
      "title": "arm64/fpsimd: Avoid clobbering kernel FPSIMD state with SMSTOP",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38169",
    "datePublished": "2025-07-03T08:36:08.393Z",
    "dateReserved": "2025-04-16T04:51:23.991Z",
    "dateUpdated": "2025-07-28T04:14:09.744Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38169\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-07-03T09:15:32.517\",\"lastModified\":\"2025-07-03T15:13:53.147\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\narm64/fpsimd: Avoid clobbering kernel FPSIMD state with SMSTOP\\n\\nOn system with SME, a thread\u0027s kernel FPSIMD state may be erroneously\\nclobbered during a context switch immediately after that state is\\nrestored. Systems without SME are unaffected.\\n\\nIf the CPU happens to be in streaming SVE mode before a context switch\\nto a thread with kernel FPSIMD state, fpsimd_thread_switch() will\\nrestore the kernel FPSIMD state using fpsimd_load_kernel_state() while\\nthe CPU is still in streaming SVE mode. When fpsimd_thread_switch()\\nsubsequently calls fpsimd_flush_cpu_state(), this will execute an\\nSMSTOP, causing an exit from streaming SVE mode. The exit from\\nstreaming SVE mode will cause the hardware to reset a number of\\nFPSIMD/SVE/SME registers, clobbering the FPSIMD state.\\n\\nFix this by calling fpsimd_flush_cpu_state() before restoring the kernel\\nFPSIMD state.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: arm64/fpsimd: Evite afectar negativamente al estado FPSIMD del kernel con SMSTOP En sistemas con SMSTOP, el estado FPSIMD del kernel de un subproceso puede verse afectado negativamente durante un cambio de contexto inmediatamente despu\u00e9s de restaurarse dicho estado. Los sistemas sin SMSTOP no se ven afectados. Si la CPU est\u00e1 en modo SVE de transmisi\u00f3n antes de un cambio de contexto a un subproceso con estado FPSIMD del kernel, fpsimd_thread_switch() restaurar\u00e1 el estado FPSIMD del kernel mediante fpsimd_load_kernel_state() mientras la CPU sigue en modo SVE de transmisi\u00f3n. Cuando fpsimd_thread_switch() llama posteriormente a fpsimd_flush_cpu_state(), se ejecutar\u00e1 un SMSTOP, lo que provocar\u00e1 la salida del modo SVE de transmisi\u00f3n. La salida del modo SVE de transmisi\u00f3n provocar\u00e1 que el hardware restablezca varios registros FPSIMD/SVE/SME, afectando negativamente al estado FPSIMD. Solucione esto llamando a fpsimd_flush_cpu_state() antes de restaurar el estado FPSIMD del kernel.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/01098d893fa8a6edb2b56e178b798e3e6b674f02\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/55d52af498daea75aa03ba9b7e444c8ae495ac20\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a305821f597ec943849d3e53924adb88c61ed682\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.