{"affected":[{"defaultStatus":"unaffected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"lessThan":"de89368de3894a8db27caeb8fd902ba1c49f696a","status":"affected","version":"8bd7f91c03d886f41d35f6108078d20be5a4a1bd","versionType":"git"},{"lessThan":"43be952e885476dafb74aa832c0847b2f4f650c6","status":"affected","version":"8bd7f91c03d886f41d35f6108078d20be5a4a1bd","versionType":"git"},{"lessThan":"6103f9ba51a59afb5a0f32299c837377c5a5a693","status":"affected","version":"8bd7f91c03d886f41d35f6108078d20be5a4a1bd","versionType":"git"},{"lessThan":"c4a4786d93e99517d6f10ed56b9ffba4ce88d3b3","status":"affected","version":"8bd7f91c03d886f41d35f6108078d20be5a4a1bd","versionType":"git"},{"lessThan":"d3eaab3c70905c5467e5c4ea403053d67505adeb","status":"affected","version":"8bd7f91c03d886f41d35f6108078d20be5a4a1bd","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"status":"affected","version":"5.19"},{"lessThan":"5.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.142","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.94","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.34","versionType":"semver"},{"lessThanOrEqual":"6.15.*","status":"unaffected","version":"6.15.3","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.16","versionType":"original_commit_for_fix"}]}],"cveId":"CVE-2025-38170","cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\narm64/fpsimd: Discard stale CPU state when handling SME traps\n\nThe logic for handling SME traps manipulates saved FPSIMD/SVE/SME state\nincorrectly, and a race with preemption can result in a task having\nTIF_SME set and TIF_FOREIGN_FPSTATE clear even though the live CPU state\nis stale (e.g. with SME traps enabled). This can result in warnings from\ndo_sme_acc() where SME traps are not expected while TIF_SME is set:\n\n|        /* With TIF_SME userspace shouldn't generate any traps */\n|        if (test_and_set_thread_flag(TIF_SME))\n|                WARN_ON(1);\n\nThis is very similar to the SVE issue we fixed in commit:\n\n  751ecf6afd6568ad (\"arm64/sve: Discard stale CPU state when handling SVE traps\")\n\nThe race can occur when the SME trap handler is preempted before and\nafter manipulating the saved FPSIMD/SVE/SME state, starting and ending on\nthe same CPU, e.g.\n\n| void do_sme_acc(unsigned long esr, struct pt_regs *regs)\n| {\n|         // Trap on CPU 0 with TIF_SME clear, SME traps enabled\n|         // task->fpsimd_cpu is 0.\n|         // per_cpu_ptr(&fpsimd_last_state, 0) is task.\n|\n|         ...\n|\n|         // Preempted; migrated from CPU 0 to CPU 1.\n|         // TIF_FOREIGN_FPSTATE is set.\n|\n|         get_cpu_fpsimd_context();\n|\n|         /* With TIF_SME userspace shouldn't generate any traps */\n|         if (test_and_set_thread_flag(TIF_SME))\n|                 WARN_ON(1);\n|\n|         if (!test_thread_flag(TIF_FOREIGN_FPSTATE)) {\n|                 unsigned long vq_minus_one =\n|                         sve_vq_from_vl(task_get_sme_vl(current)) - 1;\n|                 sme_set_vq(vq_minus_one);\n|\n|                 fpsimd_bind_task_to_cpu();\n|         }\n|\n|         put_cpu_fpsimd_context();\n|\n|         // Preempted; migrated from CPU 1 to CPU 0.\n|         // task->fpsimd_cpu is still 0\n|         // If per_cpu_ptr(&fpsimd_last_state, 0) is still task then:\n|         // - Stale HW state is reused (with SME traps enabled)\n|         // - TIF_FOREIGN_FPSTATE is cleared\n|         // - A return to userspace skips HW state restore\n| }\n\nFix the case where the state is not live and TIF_FOREIGN_FPSTATE is set\nby calling fpsimd_flush_task_state() to detach from the saved CPU\nstate. This ensures that a subsequent context switch will not reuse the\nstale CPU state, and will instead set TIF_FOREIGN_FPSTATE, forcing the\nnew state to be reloaded from memory prior to a return to userspace.\n\nNote: this was originallly posted as [1].\n\n[ Rutland: rewrite commit message ]","epss":{"date":"2026-11-05","percentile":0.0605,"score":0.00167},"exploits":[],"kev":null,"metrics":[],"modifiedAt":1793911938397,"publishedAt":1751531769012,"references":[{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/de89368de3894a8db27caeb8fd902ba1c49f696a"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/43be952e885476dafb74aa832c0847b2f4f650c6"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/6103f9ba51a59afb5a0f32299c837377c5a5a693"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/c4a4786d93e99517d6f10ed56b9ffba4ce88d3b3"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/d3eaab3c70905c5467e5c4ea403053d67505adeb"},{"source":"ADP: CVE","tags":[],"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}],"remediation":[],"revision":"b6ed9882395f52f9cde83d523ba92cc6ec802f8901cd3f03eddb0aa97a85f711","sources":[{"modifiedAt":1793911938397,"name":"CNA: Linux","retrievedAt":1793913606362,"url":"https://www.cve.org/CVERecord?id=CVE-2025-38170"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793913637540,"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-38170"}],"ssvc":{"assessedAt":1793911847797,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"arm64/fpsimd: Discard stale CPU state when handling SME traps","updatedAt":1793913637540}