CVE-2025-38435 (GCVE-0-2025-38435)

Vulnerability from cvelistv5 – Published: 2025-07-25 14:32 – Updated: 2026-08-05 12:01
VLAI
Title
riscv: vector: Fix context save/restore with xtheadvector
Summary
In the Linux kernel, the following vulnerability has been resolved: riscv: vector: Fix context save/restore with xtheadvector Previously only v0-v7 were correctly saved/restored, and the context of v8-v31 are damanged. Correctly save/restore v8-v31 to avoid breaking userspace.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: d863910eabaffc68eb28aaf476dd870fc3f7197d , < dd5ceea8d50e9e108a10d1e0d89fa2c9ff442ca2 (git)
Affected: d863910eabaffc68eb28aaf476dd870fc3f7197d , < 4262bd0d9cc704ea1365ac00afc1272400c2cbef (git)
Create a notification for this product.
Linux Linux Affected: 6.14
Unaffected: 0 , < 6.14 (semver)
Unaffected: 6.15.5 , ≤ 6.15.* (semver)
Unaffected: 6.16 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/riscv/include/asm/vector.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "dd5ceea8d50e9e108a10d1e0d89fa2c9ff442ca2",
              "status": "affected",
              "version": "d863910eabaffc68eb28aaf476dd870fc3f7197d",
              "versionType": "git"
            },
            {
              "lessThan": "4262bd0d9cc704ea1365ac00afc1272400c2cbef",
              "status": "affected",
              "version": "d863910eabaffc68eb28aaf476dd870fc3f7197d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/riscv/include/asm/vector.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.5",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: vector: Fix context save/restore with xtheadvector\n\nPreviously only v0-v7 were correctly saved/restored,\nand the context of v8-v31 are damanged.\nCorrectly save/restore v8-v31 to avoid breaking userspace."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires executing instructions on the affected hart to read and plant vector register values across a context switch; there is no remote or network-reachable path to the vector save/restore code.\nAC:L - On T-Head xtheadvector hardware the omission of v8-v31 from restore is unconditional and deterministic, so the attacker simply spins reading v8-v31 after each scheduling event; no race, memory layout, or uncontrolled state is involved, and the enabling config is default-y.\nPR:L - Any unprivileged local task can use vector (CONFIG_RISCV_ISA_V_DEFAULT_ENABLE=y, and riscv_v_vstate_ctrl_set_current() unconditionally allows PR_RISCV_V_VSTATE_CTRL_ON), so only a basic user account is needed.\nUI:N - The leak and corruption occur automatically on every context switch and signal return; no victim action beyond normal execution is required.\nS:U - The vulnerable code and the impacted processes are all governed by the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed, and guest vector is never enabled on xtheadvector hosts.\nC:H - v8-v31 are never restored, so an attacker task inherits 24 registers of another process\u0027s live vector state and can sample this continuously across context switches, harvesting arbitrary secret data that transits vectorized memcpy/string/crypto routines in privileged processes.\nI:H - The attacker can leave arbitrary chosen values in v8-v31 that a victim process then computes with, and for indexed/gather vector loads and stores those attacker-controlled values become addresses inside the victim, giving attacker-directed corruption of another process\u0027s data.\nA:H - Every vector-using process on the machine is deterministically resumed with damaged v8-v31, and an attacker can deliberately poison those registers so victims fault on indexed vector accesses, reliably crashing arbitrary processes including system daemons."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:01:52.506Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/dd5ceea8d50e9e108a10d1e0d89fa2c9ff442ca2"
        },
        {
          "url": "https://git.kernel.org/stable/c/4262bd0d9cc704ea1365ac00afc1272400c2cbef"
        }
      ],
      "title": "riscv: vector: Fix context save/restore with xtheadvector",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38435",
    "datePublished": "2025-07-25T14:32:09.136Z",
    "dateReserved": "2025-04-16T04:51:24.016Z",
    "dateUpdated": "2026-08-05T12:01:52.506Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38435",
      "date": "2026-08-05",
      "epss": "0.00144",
      "percentile": "0.04164"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38435\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-07-25T15:15:28.837\",\"lastModified\":\"2026-07-30T06:23:14.167\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nriscv: vector: Fix context save/restore with xtheadvector\\n\\nPreviously only v0-v7 were correctly saved/restored,\\nand the context of v8-v31 are damanged.\\nCorrectly save/restore v8-v31 to avoid breaking userspace.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: riscv: vector: Se corrige el guardado/restauraci\u00f3n de contexto con xtheadvector. Anteriormente, solo se guardaban/restauraban correctamente las versiones v0 a v7, y el contexto de las versiones v8 a v31 estaba da\u00f1ado. Guarde/restaure correctamente las versiones v8 a v31 para evitar la interrupci\u00f3n del espacio de usuario.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"arch/riscv/include/asm/vector.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"d863910eabaffc68eb28aaf476dd870fc3f7197d\",\"lessThan\":\"dd5ceea8d50e9e108a10d1e0d89fa2c9ff442ca2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d863910eabaffc68eb28aaf476dd870fc3f7197d\",\"lessThan\":\"4262bd0d9cc704ea1365ac00afc1272400c2cbef\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"arch/riscv/include/asm/vector.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.14\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.14\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15.5\",\"lessThanOrEqual\":\"6.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.14\",\"versionEndExcluding\":\"6.15.5\",\"matchCriteriaId\":\"B778A5DA-B42B-4637-8580-7B4583B0061B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"6D4894DB-CCFE-4602-B1BF-3960B2E19A01\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"09709862-E348-4378-8632-5A7813EDDC86\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"415BF58A-8197-43F5-B3D7-D1D63057A26E\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/4262bd0d9cc704ea1365ac00afc1272400c2cbef\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/dd5ceea8d50e9e108a10d1e0d89fa2c9ff442ca2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:33:18+00:00",
      "cve": "CVE-2025-38435",
      "id": "CVE-2025-38435",
      "initial_release_date": "2025-07-25T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: riscv: vector: Fix context save/restore with xtheadvector",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38435.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-05-13T04:09:12Z",
      "cve": "CVE-2025-38435",
      "id": "CVE-2025-38435",
      "initial_release_date": "2025-07-29T23:23:35Z",
      "product_status:known_not_affected": "345",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-38435",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-38435.json",
      "version": "5"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.