CVE-2025-68171

In the Linux kernel, the following vulnerability has been resolved:

x86/fpu: Ensure XFD state on signal delivery

Sean reported [1] the following splat when running KVM tests:

WARNING: CPU: 232 PID: 15391 at xfd_validate_state+0x65/0x70 Call Trace: <TASK> fpu__clear_user_states+0x9c/0x100 arch_do_signal_or_restart+0x142/0x210 exit_to_user_mode_loop+0x55/0x100 do_syscall_64+0x205/0x2c0 entry_SYSCALL_64_after_hwframe+0x4b/0x53

Chao further identified [2] a reproducible scenario involving signal delivery: a non-AMX task is preempted by an AMX-enabled task which modifies the XFD MSR.

When the non-AMX task resumes and reloads XSTATE with init values, a warning is triggered due to a mismatch between fpstate::xfd and the CPU's current XFD state. fpu__clear_user_states() does not currently re-synchronize the XFD state after such preemption.

Invoke xfd_update_state() which detects and corrects the mismatch if there is a dynamic feature.

This also benefits the sigreturn path, as fpu__restore_sig() may call fpu__clear_user_states() when the sigframe is inaccessible.

[ dhansen: minor changelog munging ]

A flaw of LOW severity was found in the Linux kernel's x86 FPU signal-delivery handling, affecting the Red Hat Enterprise Linux kernel and kernel-rt packages. On systems with hardware and kernel support for dynamic XSAVE features such as AMX and XFD, a local unprivileged user can cause a kernel warning and potential system instability: when a non-AMX task is preempted by an AMX-enabled task that modifies the XFD MSR, fpu__clear_user_states() can reload the task's XSTATE with init values while fpstate::xfd no longer matches the CPU's current XFD state, triggering a warning in xfd_validate_state() on the signal-delivery and sigreturn paths and, in some configurations, a kernel panic. The impact is a local denial of service only. Red Hat Enterprise Linux 6 and 7, including kernel-rt, are not affected because the vulnerable code is not present in those streams. The affected RHEL 8, RHEL 9, and RHEL 10 kernel and kernel-rt update streams, and Red Hat In-Vehicle OS 1.1, do contain the vulnerable code; given the low severity of this issue, the fix is currently deferred, and the residual risk is limited to a local denial of service that requires executing code locally on AMX-capable hardware with a particular interleaving of AMX-enabled and non-AMX tasks. Red Hat rates this issue LOW severity with a CVSS score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because only availability is impacted, which differs from the upstream CVE record score of 7.8 that additionally claims high confidentiality and integrity impacts not supported by the technical evidence.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.