{"id":"CVE-2025-22013","revision":"6ceeebe04d324531b7381dc64f4078a0","records":[{"revision":"6ceeebe04d324531b7381dc64f4078a0","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-22013","aliases":[],"title":"KVM: arm64: Unconditionally save+flush host FPSIMD/SVE/SME state","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Unconditionally save+flush host FPSIMD/SVE/SME state\n\nThere are several problems with the way hyp code lazily saves the host's\nFPSIMD/SVE state, including:\n\n* Host SVE being discarded unexpectedly due to inconsistent\n  configuration of TIF_SVE and CPACR_ELx.ZEN. This has been seen to\n  result in QEMU crashes where SVE is used by memmove(), as reported by\n  Eric Auger:\n\n  https://issues.redhat.com/browse/RHEL-68997\n\n* Host SVE state is discarded *after* modification by ptrace, which was an\n  unintentional ptrace ABI change introduced with lazy discarding of SVE state.\n\n* The host FPMR value can be discarded when running a non-protected VM,\n  where FPMR support is not exposed to a VM, and that VM uses\n  FPSIMD/SVE. In these cases the hyp code does not save the host's FPMR\n  before unbinding the host's FPSIMD/SVE/SME state, leaving a stale\n  value in memory.\n\nAvoid these by eagerly saving and \"flushing\" the host's FPSIMD/SVE/SME\nstate when loading a vCPU such that KVM does not need to save any of the\nhost's FPSIMD/SVE/SME state. For clarity, fpsimd_kvm_prepare() is\nremoved and the necessary call to fpsimd_save_and_flush_cpu_state() is\nplaced in kvm_arch_vcpu_load_fp(). As 'fpsimd_state' and 'fpmr_ptr'\nshould not be used, they are set to NULL; all uses of these will be\nremoved in subsequent patches.\n\nHistorical problems go back at least as far as v5.17, e.g. erroneous\nassumptions about TIF_SVE being clear in commit:\n\n  8383741ab2e773a9 (\"KVM: arm64: Get rid of host SVE tracking/saving\")\n\n... and so this eager save+flush probably needs to be backported to ALL\nstable trees.","state":0,"publishedAt":"2025-04-08T08:18:04+00:00","modifiedAt":"2026-10-15T21:51:56.419+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"arch/arm64/kernel/fpsimd.c\",\n                        \"arch/arm64/kvm/fpsimd.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"c4ab60a86c5ed7c0d727c6dc8cec352e16bc7f90\",\n                            \"lessThan\": \"5289ac43b69c61a49c75720921f2008005a31c43\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"d5f7d3833b534f9e43e548461dba1e60aa82f587\",\n                            \"lessThan\": \"04c50cc23a492c4d43fdaefc7c1ecc0ff6f7b82e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"93ae6b01bafee8fa385aa25ee7ebdb40057f6abe\",\n                            \"lessThan\": \"806d5c1e1d2e5502175a24bf70f251648d99c36a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"93ae6b01bafee8fa385aa25ee7ebdb40057f6abe\",\n                            \"lessThan\": \"79e140bba70bcacc5fe15bf8c0b958793fd7d56f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"93ae6b01bafee8fa385aa25ee7ebdb40057f6abe\",\n                            \"lessThan\": \"900b444be493b7f404898c785d6605b177a093d0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"93ae6b01bafee8fa385aa25ee7ebdb40057f6abe\",\n                            \"lessThan\": \"fbc7e61195e23f744814e78524b73b59faa54ab4\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"arch/arm64/kernel/fpsimd.c\",\n                        \"arch/arm64/kvm/fpsimd.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.2\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.2\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.85\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.21\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.13.9\",\n                            \"lessThanOrEqual\": \"6.13.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.14\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H","score":7.3,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/5289ac43b69c61a49c75720921f2008005a31c43","https://git.kernel.org/stable/c/04c50cc23a492c4d43fdaefc7c1ecc0ff6f7b82e","https://git.kernel.org/stable/c/806d5c1e1d2e5502175a24bf70f251648d99c36a","https://git.kernel.org/stable/c/79e140bba70bcacc5fe15bf8c0b958793fd7d56f","https://git.kernel.org/stable/c/900b444be493b7f404898c785d6605b177a093d0","https://git.kernel.org/stable/c/fbc7e61195e23f744814e78524b73b59faa54ab4"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-22013","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-22013","identifiers":["CVE-2025-22013"]},"retained":false,"historicalAffected":[]}],"coverage":[]}