CVE-2025-38670

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack()

`cpu_switch_to()` and `call_on_irq_stack()` manipulate SP to change

to different stacks along with the Shadow Call Stack if it is enabled.

Those two stack changes cannot be done atomically and both functions

can be interrupted by SErrors or Debug Exceptions which, though unlikely,

is very much broken : if interrupted, we can end up with mismatched stacks

and Shadow Call Stack leading to clobbered stacks.

In `cpu_switch_to()`, it can happen when SP_EL0 points to the new task,

but x18 stills points to the old task's SCS. When the interrupt handler

tries to save the task's SCS pointer, it will save the old task

SCS pointer (x18) into the new task struct (pointed to by SP_EL0),

clobbering it.

In `call_on_irq_stack()`, it can happen when switching from the task stack

to the IRQ stack and when switching back. In both cases, we can be

interrupted when the SCS

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References