CVE-2025-38169

A flaw was found in the Linux kernel. A local attacker could exploit a vulnerability in the arm64/fpsimd component on systems with Scalable Matrix Extension (SME) when the CPU is in streaming SVE mode. This flaw causes the kernel's Floating-Point and SIMD (FPSIMD) state to be erroneously overwritten during a context switch, leading to potential data corruption and system instability.

A moderate impact flaw was found in the Linux kernel arm64/fpsimd context-switch handling in Red Hat Enterprise Linux 9 and 10, and in Red Hat In-Vehicle OS. On arm64 systems with the Scalable Matrix Extension (SME), if the CPU is in streaming SVE mode when the scheduler switches to a thread with kernel FPSIMD state, fpsimd_thread_switch() restores that state via fpsimd_load_kernel_state() while the CPU is still in streaming SVE mode; the subsequent fpsimd_flush_cpu_state() executes an SMSTOP, and the resulting exit from streaming SVE mode causes the hardware to reset FPSIMD/SVE/SME registers, clobbering the kernel FPSIMD state that was just restored. This can result in data corruption and system instability, and can be triggered by a local user able to run code on the system. Red Hat rates this flaw Moderate severity (CVSS 5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because the demonstrated consequence is corruption of kernel FPSIMD state affecting availability, rather than the confidentiality and integrity impact reflected in the upstream CVEORG score of 7.8. Red Hat Enterprise Linux 6, 7, and 8 (kernel and kernel-rt) are not affected because the vulnerable code is not present in those releases, and systems without SME hardware are also unaffected. For the affected Red Hat Enterprise Linux 9 and 10 and Red Hat In-Vehicle OS kernel streams, the fix is currently deferred; the residual risk is that kernel FPSIMD state may be clobbered during context switches on SME-equipped systems, potentially causing data corruption or system instability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.