CVE-2025-22013

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: Unconditionally save+flush host FPSIMD/SVE/SME state

There are several problems with the way hyp code lazily saves the host's

FPSIMD/SVE state, including:

* Host SVE being discarded unexpectedly due to inconsistent

configuration of TIF_SVE and CPACR_ELx.ZEN. This has been seen to

result in QEMU crashes where SVE is used by memmove(), as reported by

Eric Auger:

https://issues.redhat.com/browse/RHEL-68997

* Host SVE state is discarded *after* modification by ptrace, which was an

unintentional ptrace ABI change introduced with lazy discarding of SVE state.

* The host FPMR value can be discarded when running a non-protected VM,

where FPMR support is not exposed to a VM, and that VM uses

FPSIMD/SVE. In these cases the hyp code does not save the host's FPMR

before unbinding the host's FPSIMD/SVE/SME state, leaving a stale

value in memory.

Avoid these by eagerly saving and "flushing" the h

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References