Executive brief
A vulnerability in the Linux kernel's handling of processor states could allow a local user to cause system instability or potentially gain unauthorized access to data. The issue occurs on x86 systems when the kernel fails to properly synchronize hardware features (like AMX) during specific background tasks or signal processing. This could lead to unpredictable system behavior or crashes in environments running specialized workloads like virtual machines.
Technical details
A race condition or logic error exists in the x86 FPU (Floating Point Unit) subsystem of the Linux kernel. Specifically, fpu__clear_user_states() failed to re-synchronize the XFD (eXtended Feature Disabling) MSR state when a task was preempted by another task using Advanced Matrix Extensions (AMX). This mismatch between the software-tracked fpstate::xfd and the actual CPU hardware state triggers kernel warnings and can lead to incorrect register state restoration during signal delivery or sigreturn paths. An attacker with local access could potentially exploit this state inconsistency to cause a denial of service or achieve local privilege escalation. The fix involves invoking xfd_update_state() to ensure hardware and software states are synchronized before reloading XSTATE.
Affected products
- Linux Linux 5.16 to 6.1.159, 6.6.117, 6.12.58, 6.17.8
Timeline
- 2025-06-09: other: Patch authored
- 2025-12-16: disclosed: CVE published
References
- https://git.kernel.org/stable/c/1811c610653c0cd21cc9add14595b7cffaeca511
- https://git.kernel.org/stable/c/388eff894d6bc5f921e9bfff0e4b0ab2684a96e9
- https://git.kernel.org/stable/c/3f735419c4b43cde42e6d408db39137b82474e31
- https://git.kernel.org/stable/c/5b2619b488f1d08b960c43c6468dd0759e8b3035
- https://git.kernel.org/stable/c/eefbfb722042fc9210d2e0ac2b063fd1abf51895