CVE-2025-38170
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2025-38170
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-38170.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2025-38170
- Downstream
- Related
- Published
- 2025-07-03T08:36:09Z
- Modified
- 2025-10-22T13:38:58.596604Z
- Summary
- arm64/fpsimd: Discard stale CPU state when handling SME traps
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
arm64/fpsimd: Discard stale CPU state when handling SME traps
The logic for handling SME traps manipulates saved FPSIMD/SVE/SME state incorrectly, and a race with preemption can result in a task having TIFSME set and TIFFOREIGNFPSTATE clear even though the live CPU state is stale (e.g. with SME traps enabled). This can result in warnings from dosmeacc() where SME traps are not expected while TIFSME is set:
| /* With TIFSME userspace shouldn't generate any traps */ | if (testandsetthreadflag(TIFSME)) | WARN_ON(1);
This is very similar to the SVE issue we fixed in commit:
751ecf6afd6568ad ("arm64/sve: Discard stale CPU state when handling SVE traps")
The race can occur when the SME trap handler is preempted before and after manipulating the saved FPSIMD/SVE/SME state, starting and ending on the same CPU, e.g.
| void dosmeacc(unsigned long esr, struct ptregs *regs) | { | // Trap on CPU 0 with TIFSME clear, SME traps enabled | // task->fpsimdcpu is 0. | // percpuptr(&fpsimdlaststate, 0) is task. | | ... | | // Preempted; migrated from CPU 0 to CPU 1. | // TIFFOREIGNFPSTATE is set. | | getcpufpsimdcontext(); | | /* With TIFSME userspace shouldn't generate any traps */ | if (testandsetthreadflag(TIFSME)) | WARNON(1); | | if (!testthreadflag(TIFFOREIGNFPSTATE)) { | unsigned long vqminusone = | svevqfromvl(taskgetsmevl(current)) - 1; | smesetvq(vqminusone); | | fpsimdbindtasktocpu(); | } | | putcpufpsimdcontext(); | | // Preempted; migrated from CPU 1 to CPU 0. | // task->fpsimdcpu is still 0 | // If percpuptr(&fpsimdlaststate, 0) is still task then: | // - Stale HW state is reused (with SME traps enabled) | // - TIFFOREIGN_FPSTATE is cleared | // - A return to userspace skips HW state restore | }
Fix the case where the state is not live and TIFFOREIGNFPSTATE is set by calling fpsimdflushtaskstate() to detach from the saved CPU state. This ensures that a subsequent context switch will not reuse the stale CPU state, and will instead set TIFFOREIGN_FPSTATE, forcing the new state to be reloaded from memory prior to a return to userspace.
Note: this was originallly posted as [1].
[ Rutland: rewrite commit message ]
- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/43be952e885476dafb74aa832c0847b2f4f650c6
- https://git.kernel.org/stable/c/6103f9ba51a59afb5a0f32299c837377c5a5a693
- https://git.kernel.org/stable/c/c4a4786d93e99517d6f10ed56b9ffba4ce88d3b3
- https://git.kernel.org/stable/c/d3eaab3c70905c5467e5c4ea403053d67505adeb
- https://git.kernel.org/stable/c/de89368de3894a8db27caeb8fd902ba1c49f696a
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced8bd7f91c03d886f41d35f6108078d20be5a4a1bdFixedde89368de3894a8db27caeb8fd902ba1c49f696a
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced8bd7f91c03d886f41d35f6108078d20be5a4a1bdFixed43be952e885476dafb74aa832c0847b2f4f650c6
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced8bd7f91c03d886f41d35f6108078d20be5a4a1bdFixed6103f9ba51a59afb5a0f32299c837377c5a5a693
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced8bd7f91c03d886f41d35f6108078d20be5a4a1bdFixedc4a4786d93e99517d6f10ed56b9ffba4ce88d3b3
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced8bd7f91c03d886f41d35f6108078d20be5a4a1bdFixedd3eaab3c70905c5467e5c4ea403053d67505adeb