CVE-2026-23102

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

arm64/fpsimd: signal: Fix restoration of SVE context

When SME is supported, Restoring SVE signal context can go wrong in a

few ways, including placing the task into an invalid state where the

kernel may read from out-of-bounds memory (and may potentially take a

fatal fault) and/or may kill the task with a SIGKILL.

(1) Restoring a context with SVE_SIG_FLAG_SM set can place the task into

an invalid state where SVCR.SM is set (and sve_state is non-NULL)

but TIF_SME is clear, consequently resuting in out-of-bounds memory

reads and/or killing the task with SIGKILL.

This can only occur in unusual (but legitimate) cases where the SVE

signal context has either been modified by userspace or was saved in

the context of another task (e.g. as with CRIU), as otherwise the

presence of an SVE signal context with SVE_SIG_FLAG_SM implies that

TIF_SME is already set.

While in this state, task_fps

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References