GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-50275 (GCVE-0-2024-50275)

Vulnerability from cvelistv5 – Published: 2024-11-19 01:30 – Updated: 2026-08-05 11:42
VLAI
Title
arm64/sve: Discard stale CPU state when handling SVE traps
Summary
In the Linux kernel, the following vulnerability has been resolved: arm64/sve: Discard stale CPU state when handling SVE traps The logic for handling SVE traps manipulates saved FPSIMD/SVE state incorrectly, and a race with preemption can result in a task having TIF_SVE set and TIF_FOREIGN_FPSTATE clear even though the live CPU state is stale (e.g. with SVE traps enabled). This has been observed to result in warnings from do_sve_acc() where SVE traps are not expected while TIF_SVE is set: | if (test_and_set_thread_flag(TIF_SVE)) | WARN_ON(1); /* SVE access shouldn't have trapped */ Warnings of this form have been reported intermittently, e.g. https://lore.kernel.org/linux-arm-kernel/CA+G9fYtEGe_DhY2Ms7+L7NKsLYUomGsgqpdBj+QwDLeSg=JhGg@mail.gmail.com/ https://lore.kernel.org/linux-arm-kernel/000000000000511e9a060ce5a45c@google.com/ The race can occur when the SVE trap handler is preempted before and after manipulating the saved FPSIMD/SVE state, starting and ending on the same CPU, e.g. | void do_sve_acc(unsigned long esr, struct pt_regs *regs) | { | // Trap on CPU 0 with TIF_SVE clear, SVE traps enabled | // task->fpsimd_cpu is 0. | // per_cpu_ptr(&fpsimd_last_state, 0) is task. | | ... | | // Preempted; migrated from CPU 0 to CPU 1. | // TIF_FOREIGN_FPSTATE is set. | | get_cpu_fpsimd_context(); | | if (test_and_set_thread_flag(TIF_SVE)) | WARN_ON(1); /* SVE access shouldn't have trapped */ | | sve_init_regs() { | if (!test_thread_flag(TIF_FOREIGN_FPSTATE)) { | ... | } else { | fpsimd_to_sve(current); | current->thread.fp_type = FP_STATE_SVE; | } | } | | put_cpu_fpsimd_context(); | | // Preempted; migrated from CPU 1 to CPU 0. | // task->fpsimd_cpu is still 0 | // If per_cpu_ptr(&fpsimd_last_state, 0) is still task then: | // - Stale HW state is reused (with SVE traps enabled) | // - TIF_FOREIGN_FPSTATE is cleared | // - A return to userspace skips HW state restore | } Fix the case where the state is not live and TIF_FOREIGN_FPSTATE is set by calling fpsimd_flush_task_state() to detach from the saved CPU state. This ensures that a subsequent context switch will not reuse the stale CPU state, and will instead set TIF_FOREIGN_FPSTATE, forcing the new state to be reloaded from memory prior to a return to userspace.
Severity
7.3 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: cccb78ce89c45a4414db712be4986edfb92434bd , < 51d3d80a6dc314982a9a0aeb0961085922a1aa15 (git)
Affected: cccb78ce89c45a4414db712be4986edfb92434bd , < de529504b3274d57caf8f66800b714b0d3ee235a (git)
Affected: cccb78ce89c45a4414db712be4986edfb92434bd , < 51d11ea0250d6ee461987403bbfd4b2abb5613a7 (git)
Affected: cccb78ce89c45a4414db712be4986edfb92434bd , < fa9ce027b3ce37a2bb173bf2553b5caa438fd8c9 (git)
Affected: cccb78ce89c45a4414db712be4986edfb92434bd , < 751ecf6afd6568adc98f2a6052315552c0483d18 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.13
Unaffected: 0 , < 5.13 (semver)
Unaffected: 5.15.174 , ≤ 5.15.* (semver)
Unaffected: 6.1.120 , ≤ 6.1.* (semver)
Unaffected: 6.6.61 , ≤ 6.6.* (semver)
Unaffected: 6.11.8 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:44:51.635Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/kernel/fpsimd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "51d3d80a6dc314982a9a0aeb0961085922a1aa15",
              "status": "affected",
              "version": "cccb78ce89c45a4414db712be4986edfb92434bd",
              "versionType": "git"
            },
            {
              "lessThan": "de529504b3274d57caf8f66800b714b0d3ee235a",
              "status": "affected",
              "version": "cccb78ce89c45a4414db712be4986edfb92434bd",
              "versionType": "git"
            },
            {
              "lessThan": "51d11ea0250d6ee461987403bbfd4b2abb5613a7",
              "status": "affected",
              "version": "cccb78ce89c45a4414db712be4986edfb92434bd",
              "versionType": "git"
            },
            {
              "lessThan": "fa9ce027b3ce37a2bb173bf2553b5caa438fd8c9",
              "status": "affected",
              "version": "cccb78ce89c45a4414db712be4986edfb92434bd",
              "versionType": "git"
            },
            {
              "lessThan": "751ecf6afd6568adc98f2a6052315552c0483d18",
              "status": "affected",
              "version": "cccb78ce89c45a4414db712be4986edfb92434bd",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/kernel/fpsimd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.13"
            },
            {
              "lessThan": "5.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.174",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.120",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.61",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.174",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.120",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.61",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.8",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64/sve: Discard stale CPU state when handling SVE traps\n\nThe logic for handling SVE traps manipulates saved FPSIMD/SVE state\nincorrectly, and a race with preemption can result in a task having\nTIF_SVE set and TIF_FOREIGN_FPSTATE clear even though the live CPU state\nis stale (e.g. with SVE traps enabled). This has been observed to result\nin warnings from do_sve_acc() where SVE traps are not expected while\nTIF_SVE is set:\n\n|         if (test_and_set_thread_flag(TIF_SVE))\n|                 WARN_ON(1); /* SVE access shouldn\u0027t have trapped */\n\nWarnings of this form have been reported intermittently, e.g.\n\n  https://lore.kernel.org/linux-arm-kernel/CA+G9fYtEGe_DhY2Ms7+L7NKsLYUomGsgqpdBj+QwDLeSg=JhGg@mail.gmail.com/\n  https://lore.kernel.org/linux-arm-kernel/000000000000511e9a060ce5a45c@google.com/\n\nThe race can occur when the SVE trap handler is preempted before and\nafter manipulating the saved FPSIMD/SVE state, starting and ending on\nthe same CPU, e.g.\n\n| void do_sve_acc(unsigned long esr, struct pt_regs *regs)\n| {\n|         // Trap on CPU 0 with TIF_SVE clear, SVE traps enabled\n|         // task-\u003efpsimd_cpu is 0.\n|         // per_cpu_ptr(\u0026fpsimd_last_state, 0) is task.\n|\n|         ...\n|\n|         // Preempted; migrated from CPU 0 to CPU 1.\n|         // TIF_FOREIGN_FPSTATE is set.\n|\n|         get_cpu_fpsimd_context();\n|\n|         if (test_and_set_thread_flag(TIF_SVE))\n|                 WARN_ON(1); /* SVE access shouldn\u0027t have trapped */\n|\n|         sve_init_regs() {\n|                 if (!test_thread_flag(TIF_FOREIGN_FPSTATE)) {\n|                         ...\n|                 } else {\n|                         fpsimd_to_sve(current);\n|                         current-\u003ethread.fp_type = FP_STATE_SVE;\n|                 }\n|         }\n|\n|         put_cpu_fpsimd_context();\n|\n|         // Preempted; migrated from CPU 1 to CPU 0.\n|         // task-\u003efpsimd_cpu is still 0\n|         // If per_cpu_ptr(\u0026fpsimd_last_state, 0) is still task then:\n|         // - Stale HW state is reused (with SVE traps enabled)\n|         // - TIF_FOREIGN_FPSTATE is cleared\n|         // - A return to userspace skips HW state restore\n| }\n\nFix the case where the state is not live and TIF_FOREIGN_FPSTATE is set\nby calling fpsimd_flush_task_state() to detach from the saved CPU\nstate. This ensures that a subsequent context switch will not reuse the\nstale CPU state, and will instead set TIF_FOREIGN_FPSTATE, forcing the\nnew state to be reloaded from memory prior to a return to userspace."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is the EL0 SVE access trap handler, reached only by a local process on the machine executing an SVE instruction. No network or remote input is involved.\nAC:L - The attacker controls both halves of the race \u2014 both windows around get/put_cpu_fpsimd_context() are fully preemptible, and the attacker can force preemption and CPU0\u2192CPU1\u2192CPU0 migration by oversubscribing a restricted affinity mask, while re-arming the SVE trap indefinitely (any syscall saves state as FPSIMD, clearing TIF_SVE and re-enabling the trap).\nPR:L - Only the ability to run unprivileged code is needed; el0_sve_acc()/do_sve_acc() perform no capability, namespace, or credential check of any kind.\nUI:N - The attacking process triggers the trap and the race entirely on its own; no action by any other user is required.\nS:U - The impact stays within the kernel/OS security authority \u2014 corrupted FP/SVE state tracking and kernel warnings on the same host, with no VM, IOMMU, or hypervisor boundary crossed.\nC:H - Skipping sve_flush_live() leaves SVE predicate registers P0-P15 and FFR from a previously running task\u0027s SVE context in the register file while the kernel treats them as the current task\u0027s live SVE state, so they are saved into thread.sve_state and copied to userspace by preserve_sve_context() (or read via ptrace NT_ARM_SVE) \u2014 a cross-process disclosure of up to 17 \u00d7 VL/8 bytes, ~4 KB on max-VL hardware.\nI:L - Foreign SVE predicate/FFR contents are injected into the task\u0027s architectural state and the correctly converted in-memory state is silently discarded, but the WARN_ON(sve_get_vl() != vl) guard in fpsimd_save_user_state() blocks the mismatched-VL out-of-bounds save, so there is no arbitrary-write or control-flow primitive.\nA:H - The stale state reliably produces the WARN_ON(1) splat in do_sve_acc() \u2014 a kernel panic on the many panic_on_warn deployments (CI, hardened, cloud, Android) \u2014 and the VL-mismatch path additionally force-SIGKILLs the task; an unprivileged user can trigger this in a tight loop."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:42:58.345Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/51d3d80a6dc314982a9a0aeb0961085922a1aa15"
        },
        {
          "url": "https://git.kernel.org/stable/c/de529504b3274d57caf8f66800b714b0d3ee235a"
        },
        {
          "url": "https://git.kernel.org/stable/c/51d11ea0250d6ee461987403bbfd4b2abb5613a7"
        },
        {
          "url": "https://git.kernel.org/stable/c/fa9ce027b3ce37a2bb173bf2553b5caa438fd8c9"
        },
        {
          "url": "https://git.kernel.org/stable/c/751ecf6afd6568adc98f2a6052315552c0483d18"
        }
      ],
      "title": "arm64/sve: Discard stale CPU state when handling SVE traps",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-50275",
    "datePublished": "2024-11-19T01:30:15.293Z",
    "dateReserved": "2024-10-21T19:36:19.983Z",
    "dateUpdated": "2026-08-05T11:42:58.345Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-50275",
      "date": "2026-09-16",
      "epss": "0.00242",
      "percentile": "0.15507"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.13\", \"versionEndExcluding\": \"6.6.61\", \"matchCriteriaId\": \"4713F9C0-902B-42E7-8BC3-EA25AE3D4238\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.11.8\", \"matchCriteriaId\": \"0BD000F7-3DAD-4DD3-8906-98EA1EC67E95\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"7F361E1D-580F-4A2D-A509-7615F73167A1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"925478D0-3E3D-4E6F-ACD5-09F28D5DF82C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*\", \"matchCriteriaId\": \"3C95E234-D335-4B6C-96BF-E2CEBD8654ED\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc4:*:*:*:*:*:*\", \"matchCriteriaId\": \"E0F717D8-3014-4F84-8086-0124B2111379\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc5:*:*:*:*:*:*\", \"matchCriteriaId\": \"24DBE6C7-2AAE-4818-AED2-E131F153D2FA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc6:*:*:*:*:*:*\", \"matchCriteriaId\": \"24B88717-53F5-42AA-9B72-14C707639E3F\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\narm64/sve: Discard stale CPU state when handling SVE traps\\n\\nThe logic for handling SVE traps manipulates saved FPSIMD/SVE state\\nincorrectly, and a race with preemption can result in a task having\\nTIF_SVE set and TIF_FOREIGN_FPSTATE clear even though the live CPU state\\nis stale (e.g. with SVE traps enabled). This has been observed to result\\nin warnings from do_sve_acc() where SVE traps are not expected while\\nTIF_SVE is set:\\n\\n|         if (test_and_set_thread_flag(TIF_SVE))\\n|                 WARN_ON(1); /* SVE access shouldn\u0027t have trapped */\\n\\nWarnings of this form have been reported intermittently, e.g.\\n\\n  https://lore.kernel.org/linux-arm-kernel/CA+G9fYtEGe_DhY2Ms7+L7NKsLYUomGsgqpdBj+QwDLeSg=JhGg@mail.gmail.com/\\n  https://lore.kernel.org/linux-arm-kernel/000000000000511e9a060ce5a45c@google.com/\\n\\nThe race can occur when the SVE trap handler is preempted before and\\nafter manipulating the saved FPSIMD/SVE state, starting and ending on\\nthe same CPU, e.g.\\n\\n| void do_sve_acc(unsigned long esr, struct pt_regs *regs)\\n| {\\n|         // Trap on CPU 0 with TIF_SVE clear, SVE traps enabled\\n|         // task-\u003efpsimd_cpu is 0.\\n|         // per_cpu_ptr(\u0026fpsimd_last_state, 0) is task.\\n|\\n|         ...\\n|\\n|         // Preempted; migrated from CPU 0 to CPU 1.\\n|         // TIF_FOREIGN_FPSTATE is set.\\n|\\n|         get_cpu_fpsimd_context();\\n|\\n|         if (test_and_set_thread_flag(TIF_SVE))\\n|                 WARN_ON(1); /* SVE access shouldn\u0027t have trapped */\\n|\\n|         sve_init_regs() {\\n|                 if (!test_thread_flag(TIF_FOREIGN_FPSTATE)) {\\n|                         ...\\n|                 } else {\\n|                         fpsimd_to_sve(current);\\n|                         current-\u003ethread.fp_type = FP_STATE_SVE;\\n|                 }\\n|         }\\n|\\n|         put_cpu_fpsimd_context();\\n|\\n|         // Preempted; migrated from CPU 1 to CPU 0.\\n|         // task-\u003efpsimd_cpu is still 0\\n|         // If per_cpu_ptr(\u0026fpsimd_last_state, 0) is still task then:\\n|         // - Stale HW state is reused (with SVE traps enabled)\\n|         // - TIF_FOREIGN_FPSTATE is cleared\\n|         // - A return to userspace skips HW state restore\\n| }\\n\\nFix the case where the state is not live and TIF_FOREIGN_FPSTATE is set\\nby calling fpsimd_flush_task_state() to detach from the saved CPU\\nstate. This ensures that a subsequent context switch will not reuse the\\nstale CPU state, and will instead set TIF_FOREIGN_FPSTATE, forcing the\\nnew state to be reloaded from memory prior to a return to userspace.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: arm64/sve: descartar estado de CPU obsoleto al manejar trampas SVE La l\\u00f3gica para manejar trampas SVE manipula incorrectamente el estado FPSIMD/SVE guardado, y una ejecuci\\u00f3n con preempci\\u00f3n puede resultar en una tarea que tenga TIF_SVE establecido y TIF_FOREIGN_FPSTATE borrado incluso aunque el estado de CPU en vivo est\\u00e9 obsoleto (por ejemplo, con trampas SVE habilitadas). Se ha observado que esto da como resultado advertencias de do_sve_acc() donde no se esperan trampas SVE mientras TIF_SVE est\\u00e1 establecido: | if (test_and_set_thread_flag(TIF_SVE)) | WARN_ON(1); /* El acceso a SVE no deber\\u00eda haber generado una trampa */ Se han informado advertencias de este formato de forma intermitente, por ejemplo, https://lore.kernel.org/linux-arm-kernel/CA+G9fYtEGe_DhY2Ms7+L7NKsLYUomGsgqpdBj+QwDLeSg=JhGg@mail.gmail.com/ https://lore.kernel.org/linux-arm-kernel/000000000000511e9a060ce5a45c@google.com/ La ejecuci\\u00f3n puede ocurrir cuando el controlador de trampa SVE se interrumpe antes y despu\\u00e9s de manipular el estado FPSIMD/SVE guardado, comenzando y terminando en la misma CPU, por ejemplo, | void do_sve_acc(unsigned long esr, struct pt_regs *regs) | { | // Trampa en CPU 0 con TIF_SVE limpio, trampas SVE habilitadas | // task-\u0026gt;fpsimd_cpu es 0. | // per_cpu_ptr(\u0026amp;fpsimd_last_state, 0) es la tarea. | | ... | | // Preempleado; migrado de la CPU 0 a la CPU 1. | // TIF_FOREIGN_FPSTATE est\\u00e1 establecido. | | get_cpu_fpsimd_context(); | | if (test_and_set_thread_flag(TIF_SVE)) | WARN_ON(1); /* El acceso a SVE no deber\\u00eda haber quedado atrapado */ | | sve_init_regs() { | if (!test_thread_flag(TIF_FOREIGN_FPSTATE)) { | ... | } else { | fpsimd_to_sve(current); | current-\u0026gt;thread.fp_type = FP_STATE_SVE; | } | } | | put_cpu_fpsimd_context(); | | // Preempleado; migrado de CPU 1 a CPU 0. | // task-\u0026gt;fpsimd_cpu sigue siendo 0 | // Si per_cpu_ptr(\u0026amp;fpsimd_last_state, 0) sigue siendo tarea entonces: | // - Se reutiliza el estado de HW obsoleto (con trampas SVE habilitadas) | // - Se borra TIF_FOREIGN_FPSTATE | // - Un retorno al espacio de usuario omite la restauraci\\u00f3n del estado de HW | } Corrija el caso donde el estado no est\\u00e1 activo y TIF_FOREIGN_FPSTATE se establece llamando a fpsimd_flush_task_state() para separarse del estado de CPU guardado. Esto garantiza que un cambio de contexto posterior no reutilizar\\u00e1 el estado de CPU obsoleto y, en su lugar, establecer\\u00e1 TIF_FOREIGN_FPSTATE, lo que obligar\\u00e1 a que el nuevo estado se vuelva a cargar desde la memoria antes de un retorno al espacio de usuario.\"}]",
      "id": "CVE-2024-50275",
      "lastModified": "2024-12-14T21:15:34.270",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.0, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.0, \"impactScore\": 5.9}]}",
      "published": "2024-11-19T02:16:29.760",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/51d11ea0250d6ee461987403bbfd4b2abb5613a7\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/51d3d80a6dc314982a9a0aeb0961085922a1aa15\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/751ecf6afd6568adc98f2a6052315552c0483d18\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/de529504b3274d57caf8f66800b714b0d3ee235a\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/fa9ce027b3ce37a2bb173bf2553b5caa438fd8c9\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"NVD-CWE-noinfo\"}]}]"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-19T01:15:42.000Z",
      "cve": "CVE-2024-50275",
      "id": "msrc_CVE-2024-50275",
      "initial_release_date": "2024-11-02T00:00:00.000Z",
      "product_status:fixed": "5",
      "product_status:known_affected": "5",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "arm64/sve: Discard stale CPU state when handling SVE traps",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-50275.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-50275\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-11-19T02:16:29.760\",\"lastModified\":\"2026-08-04T11:21:39.657\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\narm64/sve: Discard stale CPU state when handling SVE traps\\n\\nThe logic for handling SVE traps manipulates saved FPSIMD/SVE state\\nincorrectly, and a race with preemption can result in a task having\\nTIF_SVE set and TIF_FOREIGN_FPSTATE clear even though the live CPU state\\nis stale (e.g. with SVE traps enabled). This has been observed to result\\nin warnings from do_sve_acc() where SVE traps are not expected while\\nTIF_SVE is set:\\n\\n|         if (test_and_set_thread_flag(TIF_SVE))\\n|                 WARN_ON(1); /* SVE access shouldn\u0027t have trapped */\\n\\nWarnings of this form have been reported intermittently, e.g.\\n\\n  https://lore.kernel.org/linux-arm-kernel/CA+G9fYtEGe_DhY2Ms7+L7NKsLYUomGsgqpdBj+QwDLeSg=JhGg@mail.gmail.com/\\n  https://lore.kernel.org/linux-arm-kernel/000000000000511e9a060ce5a45c@google.com/\\n\\nThe race can occur when the SVE trap handler is preempted before and\\nafter manipulating the saved FPSIMD/SVE state, starting and ending on\\nthe same CPU, e.g.\\n\\n| void do_sve_acc(unsigned long esr, struct pt_regs *regs)\\n| {\\n|         // Trap on CPU 0 with TIF_SVE clear, SVE traps enabled\\n|         // task-\u003efpsimd_cpu is 0.\\n|         // per_cpu_ptr(\u0026fpsimd_last_state, 0) is task.\\n|\\n|         ...\\n|\\n|         // Preempted; migrated from CPU 0 to CPU 1.\\n|         // TIF_FOREIGN_FPSTATE is set.\\n|\\n|         get_cpu_fpsimd_context();\\n|\\n|         if (test_and_set_thread_flag(TIF_SVE))\\n|                 WARN_ON(1); /* SVE access shouldn\u0027t have trapped */\\n|\\n|         sve_init_regs() {\\n|                 if (!test_thread_flag(TIF_FOREIGN_FPSTATE)) {\\n|                         ...\\n|                 } else {\\n|                         fpsimd_to_sve(current);\\n|                         current-\u003ethread.fp_type = FP_STATE_SVE;\\n|                 }\\n|         }\\n|\\n|         put_cpu_fpsimd_context();\\n|\\n|         // Preempted; migrated from CPU 1 to CPU 0.\\n|         // task-\u003efpsimd_cpu is still 0\\n|         // If per_cpu_ptr(\u0026fpsimd_last_state, 0) is still task then:\\n|         // - Stale HW state is reused (with SVE traps enabled)\\n|         // - TIF_FOREIGN_FPSTATE is cleared\\n|         // - A return to userspace skips HW state restore\\n| }\\n\\nFix the case where the state is not live and TIF_FOREIGN_FPSTATE is set\\nby calling fpsimd_flush_task_state() to detach from the saved CPU\\nstate. This ensures that a subsequent context switch will not reuse the\\nstale CPU state, and will instead set TIF_FOREIGN_FPSTATE, forcing the\\nnew state to be reloaded from memory prior to a return to userspace.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: arm64/sve: descartar estado de CPU obsoleto al manejar trampas SVE La l\u00f3gica para manejar trampas SVE manipula incorrectamente el estado FPSIMD/SVE guardado, y una ejecuci\u00f3n con preempci\u00f3n puede resultar en una tarea que tenga TIF_SVE establecido y TIF_FOREIGN_FPSTATE borrado incluso aunque el estado de CPU en vivo est\u00e9 obsoleto (por ejemplo, con trampas SVE habilitadas). Se ha observado que esto da como resultado advertencias de do_sve_acc() donde no se esperan trampas SVE mientras TIF_SVE est\u00e1 establecido: | if (test_and_set_thread_flag(TIF_SVE)) | WARN_ON(1); /* El acceso a SVE no deber\u00eda haber generado una trampa */ Se han informado advertencias de este formato de forma intermitente, por ejemplo, https://lore.kernel.org/linux-arm-kernel/CA+G9fYtEGe_DhY2Ms7+L7NKsLYUomGsgqpdBj+QwDLeSg=JhGg@mail.gmail.com/ https://lore.kernel.org/linux-arm-kernel/000000000000511e9a060ce5a45c@google.com/ La ejecuci\u00f3n puede ocurrir cuando el controlador de trampa SVE se interrumpe antes y despu\u00e9s de manipular el estado FPSIMD/SVE guardado, comenzando y terminando en la misma CPU, por ejemplo, | void do_sve_acc(unsigned long esr, struct pt_regs *regs) | { | // Trampa en CPU 0 con TIF_SVE limpio, trampas SVE habilitadas | // task-\u0026gt;fpsimd_cpu es 0. | // per_cpu_ptr(\u0026amp;fpsimd_last_state, 0) es la tarea. | | ... | | // Preempleado; migrado de la CPU 0 a la CPU 1. | // TIF_FOREIGN_FPSTATE est\u00e1 establecido. | | get_cpu_fpsimd_context(); | | if (test_and_set_thread_flag(TIF_SVE)) | WARN_ON(1); /* El acceso a SVE no deber\u00eda haber quedado atrapado */ | | sve_init_regs() { | if (!test_thread_flag(TIF_FOREIGN_FPSTATE)) { | ... | } else { | fpsimd_to_sve(current); | current-\u0026gt;thread.fp_type = FP_STATE_SVE; | } | } | | put_cpu_fpsimd_context(); | | // Preempleado; migrado de CPU 1 a CPU 0. | // task-\u0026gt;fpsimd_cpu sigue siendo 0 | // Si per_cpu_ptr(\u0026amp;fpsimd_last_state, 0) sigue siendo tarea entonces: | // - Se reutiliza el estado de HW obsoleto (con trampas SVE habilitadas) | // - Se borra TIF_FOREIGN_FPSTATE | // - Un retorno al espacio de usuario omite la restauraci\u00f3n del estado de HW | } Corrija el caso donde el estado no est\u00e1 activo y TIF_FOREIGN_FPSTATE se establece llamando a fpsimd_flush_task_state() para separarse del estado de CPU guardado. Esto garantiza que un cambio de contexto posterior no reutilizar\u00e1 el estado de CPU obsoleto y, en su lugar, establecer\u00e1 TIF_FOREIGN_FPSTATE, lo que obligar\u00e1 a que el nuevo estado se vuelva a cargar desde la memoria antes de un retorno al espacio de usuario.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"arch/arm64/kernel/fpsimd.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"cccb78ce89c45a4414db712be4986edfb92434bd\",\"lessThan\":\"51d3d80a6dc314982a9a0aeb0961085922a1aa15\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"cccb78ce89c45a4414db712be4986edfb92434bd\",\"lessThan\":\"de529504b3274d57caf8f66800b714b0d3ee235a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"cccb78ce89c45a4414db712be4986edfb92434bd\",\"lessThan\":\"51d11ea0250d6ee461987403bbfd4b2abb5613a7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"cccb78ce89c45a4414db712be4986edfb92434bd\",\"lessThan\":\"fa9ce027b3ce37a2bb173bf2553b5caa438fd8c9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"cccb78ce89c45a4414db712be4986edfb92434bd\",\"lessThan\":\"751ecf6afd6568adc98f2a6052315552c0483d18\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"arch/arm64/kernel/fpsimd.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.13\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.13\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.174\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.120\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.61\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11.8\",\"lessThanOrEqual\":\"6.11.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H\",\"baseScore\":7.3,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.5},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.0,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.13\",\"versionEndExcluding\":\"6.6.61\",\"matchCriteriaId\":\"4713F9C0-902B-42E7-8BC3-EA25AE3D4238\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.11.8\",\"matchCriteriaId\":\"0BD000F7-3DAD-4DD3-8906-98EA1EC67E95\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F361E1D-580F-4A2D-A509-7615F73167A1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"925478D0-3E3D-4E6F-ACD5-09F28D5DF82C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"3C95E234-D335-4B6C-96BF-E2CEBD8654ED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"E0F717D8-3014-4F84-8086-0124B2111379\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"24DBE6C7-2AAE-4818-AED2-E131F153D2FA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"24B88717-53F5-42AA-9B72-14C707639E3F\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/51d11ea0250d6ee461987403bbfd4b2abb5613a7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/51d3d80a6dc314982a9a0aeb0961085922a1aa15\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/751ecf6afd6568adc98f2a6052315552c0483d18\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/de529504b3274d57caf8f66800b714b0d3ee235a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/fa9ce027b3ce37a2bb173bf2553b5caa438fd8c9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T14:02:17+00:00",
      "cve": "CVE-2024-50275",
      "id": "CVE-2024-50275",
      "initial_release_date": "2024-11-19T00:00:00+00:00",
      "product_status:fixed": "829",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: arm64/sve: Discard stale CPU state when handling SVE traps",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-50275.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-02T01:24:34Z",
      "cve": "CVE-2024-50275",
      "id": "CVE-2024-50275",
      "initial_release_date": "2024-11-19T03:49:23Z",
      "product_status:known_affected": "492",
      "product_status:known_not_affected": "319",
      "product_status:recommended": "431",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-50275",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-50275.json",
      "version": "67"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.