CVE-2025-21632

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

x86/fpu: Ensure shadow stack is active before "getting" registers

The x86 shadow stack support has its own set of registers. Those registers

are XSAVE-managed, but they are "supervisor state components" which means

that userspace can not touch them with XSAVE/XRSTOR. It also means that

they are not accessible from the existing ptrace ABI for XSAVE state.

Thus, there is a new ptrace get/set interface for it.

The regset code that ptrace uses provides an ->active() handler in

addition to the get/set ones. For shadow stack this ->active() handler

verifies that shadow stack is enabled via the ARCH_SHSTK_SHSTK bit in the

thread struct. The ->active() handler is checked from some call sites of

the regset get/set handlers, but not the ptrace ones. This was not

understood when shadow stack support was put in place.

As a result, both the set/get handlers can be called with

XFEATURE_CET_USER in its init state, which would ca

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References