CVE-2025-22013

A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem on ARM64 architectures. The hypervisor improperly manages host floating-point and vector register states when switching context to a virtual machine. A local user with privileges to run virtual machines can exploit this flaw to cause host virtualization processes to crash, resulting in a Denial of Service (DoS), or potentially cause register state corruption.

A flaw was found in the Linux kernel's KVM subsystem on ARM64 systems. The hypervisor code lazily saves the host's FPSIMD/SVE/SME floating-point and vector register state when switching context to a virtual machine, and that state can be improperly discarded, for example due to inconsistent TIF_SVE and CPACR_ELx.ZEN configuration, after ptrace modification of SVE state, or by leaving a stale host FPMR value in memory when a non-protected VM uses FPSIMD/SVE. A local user with privileges to run virtual machines on an affected ARM64 host could exploit this flaw to crash host virtualization processes (such as QEMU), resulting in a denial of service, or potentially cause host register state corruption. Red Hat has rated this flaw as Moderate for Red Hat Enterprise Linux, reflecting a local, availability-only impact (CVSS 5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Red Hat Enterprise Linux 9 and 10 (kernel and kernel-rt) are affected on ARM64; Red Hat Enterprise Linux 6, 7, and 8, Red Hat In-Vehicle OS, and Red Hat's hosted OpenShift offerings are not affected because the vulnerable code is not present in those products. Because the flaw has a Moderate, local, availability-only impact and requires privileges to run virtual machines, the fix for the affected streams is deferred to a future update; the residual risk is a denial of service or register state corruption limited to ARM64 KVM hosts where users with virtualization privileges are not fully trusted. The upstream CVE record rates this issue as Important (CVSS 7.3) including confidentiality and integrity impacts; Red Hat's assessment reflects that the demonstrated consequence is a crash of host virtualization processes rather than a confirmed confidentiality or integrity compromise.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.