CVE-2025-38170

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

arm64/fpsimd: Discard stale CPU state when handling SME traps

The logic for handling SME traps manipulates saved FPSIMD/SVE/SME state

incorrectly, and a race with preemption can result in a task having

TIF_SME set and TIF_FOREIGN_FPSTATE clear even though the live CPU state

is stale (e.g. with SME traps enabled). This can result in warnings from

do_sme_acc() where SME traps are not expected while TIF_SME is set:

| /* With TIF_SME userspace shouldn't generate any traps */

| if (test_and_set_thread_flag(TIF_SME))

| WARN_ON(1);

This is very similar to the SVE issue we fixed in commit:

751ecf6afd6568ad ("arm64/sve: Discard stale CPU state when handling SVE traps")

The race can occur when the SME trap handler is preempted before and

after manipulating the saved FPSIMD/SVE/SME state, starting and ending on

the same CPU, e.g.

| void do_sme_acc(unsigned long esr, struct pt_regs *regs)

| {

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References