Executive brief
The Linux kernel contains a memory corruption vulnerability in how it clears the FFR (predicate register) context when running in ARM64 Scalable Matrix Extension (SME) streaming mode. When processors with non-standard vector lengths perform certain operations, the incorrect clearing routine can corrupt memory adjacent to kernel data structures, potentially causing system instability or providing an avenue for privilege escalation in multi-user systems.
Technical details
The vulnerability exists in the arm64 SME handling code where an unconditional 8-byte store operation is used to clear the FFR field in the in-memory context structure. This approach fails when the SME vector length is anything other than 64 bytes, resulting in either incomplete clearing of the field or corruption of memory immediately following the structure. The root cause is in commit 9f5848665788 which made FFR access optional but did not account for variable vector lengths. An attacker with local access to trigger SME-related operations can cause kmalloc redzone corruption and kfence splats. The fix replaces the fixed-size 8-byte store with a variable-length predicate register store using PFALSE instruction, ensuring the entire field is properly cleared regardless of vector length. Patches are available.
Affected products
- Linux Linux kernel affected versions including commit 9f5848665788
Timeline
- 2025-10-22: disclosed
- 2025-10-22: patched