CVE-2026-23107

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA

The code to restore a ZA context doesn't attempt to allocate the task's

sve_state before setting TIF_SME. Consequently, restoring a ZA context

can place a task into an invalid state where TIF_SME is set but the

task's sve_state is NULL.

In legitimate but uncommon cases where the ZA signal context was NOT

created by the kernel in the context of the same task (e.g. if the task

is saved/restored with something like CRIU), we have no guarantee that

sve_state had been allocated previously. In these cases, userspace can

enter streaming mode without trapping while sve_state is NULL, causing a

later NULL pointer dereference when the kernel attempts to store the

register state:

| # ./sigreturn-za

| Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000

| Mem abort info:

| ESR = 0x0000000096000046

| EC = 0x25: DABT (current EL), I

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References