CVE-2021-47226
kernel: x86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer
Severity
LowRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · May 21, 2024
Updated · October 30, 2026
Description
A flaw was found in the Linux kernel's x86 Floating Point Unit (FPU) subsystem. When restoring processor register states from a user memory buffer fails, the kernel fails to properly invalidate preserved hardware registers. A local user could exploit this flaw under specific timing conditions to cause information disclosure or data corruption across different running processes.
Statement
This vulnerability is rated as Low severity because triggering it requires local system access and relies on highly specific, complex microarchitectural timing conditions during signal frame processing. While improper handling of failed floating-point register restorations could theoretically allow state corruption between threads on x86 architectures, achieving consistent or targeted exploitation is exceptionally difficult in standard environments.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-402 · Transmission of Private Resources into a New Sphere ('Resource Leak')