{"id":"CVE-2025-38170","title":"arm64/fpsimd: Discard stale CPU state when handling SME traps","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\narm64/fpsimd: Discard stale CPU state when handling SME traps\n\nThe logic for handling SME traps manipulates saved FPSIMD/SVE/SME state\nincorrectly, and a race with pree…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 8bd7f91c03d886f41d35f6108078d20be5a4a1bd < de89368de3894a8db27caeb8fd902ba1c49f696a","Linux >= 8bd7f91c03d886f41d35f6108078d20be5a4a1bd < 43be952e885476dafb74aa832c0847b2f4f650c6","Linux >= 8bd7f91c03d886f41d35f6108078d20be5a4a1bd < 6103f9ba51a59afb5a0f32299c837377c5a5a693","Linux >= 8bd7f91c03d886f41d35f6108078d20be5a4a1bd < c4a4786d93e99517d6f10ed56b9ffba4ce88d3b3","Linux >= 8bd7f91c03d886f41d35f6108078d20be5a4a1bd < d3eaab3c70905c5467e5c4ea403053d67505adeb","Linux 5.19"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-05T20:50:47.797468Z"},"published":"2025-07-03","updated":"2026-11-05","sourceUpdated":"2026-11-05T20:52:18.397Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-38170","references":[{"url":"https://git.kernel.org/stable/c/de89368de3894a8db27caeb8fd902ba1c49f696a"},{"url":"https://git.kernel.org/stable/c/43be952e885476dafb74aa832c0847b2f4f650c6"},{"url":"https://git.kernel.org/stable/c/6103f9ba51a59afb5a0f32299c837377c5a5a693"},{"url":"https://git.kernel.org/stable/c/c4a4786d93e99517d6f10ed56b9ffba4ce88d3b3"},{"url":"https://git.kernel.org/stable/c/d3eaab3c70905c5467e5c4ea403053d67505adeb"}],"tags":["cve.org"],"epss":0.00171,"epssPercentile":0.06565,"ingestedAt":"2026-11-05T22:38:31.926Z","slug":"CVE-2025-38170","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\narm64/fpsimd: Discard stale CPU state when handling SME traps\n\nThe logic for handling SME traps manipulates saved FPSIMD/SVE/SME state\nincorrectly, and a race with preemption can result in a task having\nTIF_SME set and TIF_FOREIGN_FPSTATE clear even though the live CPU state\nis stale (e.g. with SME traps enabled). This can result in warnings from\ndo_sme_acc() where SME traps are not expected while TIF_SME is set:\n\n|        /* With TIF_SME userspace shouldn't generate any traps */\n|        if (test_and_set_thread_flag(TIF_SME))\n|                WARN_ON(1);\n\nThis is very similar to the SVE issue we fixed in commit:\n\n  751ecf6afd6568ad (\"arm64/sve: Discard stale CPU state when handling SVE traps\")\n\nThe race can occur when the SME trap handler is preempted before and\nafter manipulating the saved FPSIMD/SVE/SME state, starting and ending on\nthe same CPU, e.g.\n\n| void do_sme_acc(unsigned long esr, struct pt_regs *regs)\n| {\n|         // Trap on CPU 0 with TIF_SME clear, SME traps enabled\n|         // task->fpsimd_cpu is 0.\n|         // per_cpu_ptr(&fpsimd_last_state, 0) is task.\n|\n|         ...\n|\n|         // Preempted; migrated from CPU 0 to CPU 1.\n|         // TIF_FOREIGN_FPSTATE is set.\n|\n|         get_cpu_fpsimd_context();\n|\n|         /* With TIF_SME userspace shouldn't generate any traps */\n|         if (test_and_set_thread_flag(TIF_SME))\n|                 WARN_ON(1);\n|\n|         if (!test_thread_flag(TIF_FOREIGN_FPSTATE)) {\n|                 unsigned long vq_minus_one =\n|                         sve_vq_from_vl(task_get_sme_vl(current)) - 1;\n|                 sme_set_vq(vq_minus_one);\n|\n|                 fpsimd_bind_task_to_cpu();\n|         }\n|\n|         put_cpu_fpsimd_context();\n|\n|         // Preempted; migrated from CPU 1 to CPU 0.\n|         // task->fpsimd_cpu is still 0\n|         // If per_cpu_ptr(&fpsimd_last_state, 0) is still task then:\n|         // - Stale HW state is reused (with SME traps enabled)\n|         // - TIF_FOREIGN_FPSTATE is cleared\n|         // - A return to userspace skips HW state restore\n| }\n\nFix the case where the state is not live and TIF_FOREIGN_FPSTATE is set\nby calling fpsimd_flush_task_state() to detach from the saved CPU\nstate. This ensures that a subsequent context switch will not reuse the\nstale CPU state, and will instead set TIF_FOREIGN_FPSTATE, forcing the\nnew state to be reloaded from memory prior to a return to userspace.\n\nNote: this was originallly posted as [1].\n\n[ Rutland: rewrite commit message ]\n\n## Affected\n\n- `Linux >= 8bd7f91c03d886f41d35f6108078d20be5a4a1bd < de89368de3894a8db27caeb8fd902ba1c49f696a`\n- `Linux >= 8bd7f91c03d886f41d35f6108078d20be5a4a1bd < 43be952e885476dafb74aa832c0847b2f4f650c6`\n- `Linux >= 8bd7f91c03d886f41d35f6108078d20be5a4a1bd < 6103f9ba51a59afb5a0f32299c837377c5a5a693`\n- `Linux >= 8bd7f91c03d886f41d35f6108078d20be5a4a1bd < c4a4786d93e99517d6f10ed56b9ffba4ce88d3b3`\n- `Linux >= 8bd7f91c03d886f41d35f6108078d20be5a4a1bd < d3eaab3c70905c5467e5c4ea403053d67505adeb`\n- `Linux 5.19`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}