FKIE_CVE-2026-23102

Vulnerability from fkie_nvd - Published: 2026-02-04 17:16 - Updated: 2026-02-06 17:16
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: arm64/fpsimd: signal: Fix restoration of SVE context When SME is supported, Restoring SVE signal context can go wrong in a few ways, including placing the task into an invalid state where the kernel may read from out-of-bounds memory (and may potentially take a fatal fault) and/or may kill the task with a SIGKILL. (1) Restoring a context with SVE_SIG_FLAG_SM set can place the task into an invalid state where SVCR.SM is set (and sve_state is non-NULL) but TIF_SME is clear, consequently resuting in out-of-bounds memory reads and/or killing the task with SIGKILL. This can only occur in unusual (but legitimate) cases where the SVE signal context has either been modified by userspace or was saved in the context of another task (e.g. as with CRIU), as otherwise the presence of an SVE signal context with SVE_SIG_FLAG_SM implies that TIF_SME is already set. While in this state, task_fpsimd_load() will NOT configure SMCR_ELx (leaving some arbitrary value configured in hardware) before restoring SVCR and attempting to restore the streaming mode SVE registers from memory via sve_load_state(). As the value of SMCR_ELx.LEN may be larger than the task's streaming SVE vector length, this may read memory outside of the task's allocated sve_state, reading unrelated data and/or triggering a fault. While this can result in secrets being loaded into streaming SVE registers, these values are never exposed. As TIF_SME is clear, fpsimd_bind_task_to_cpu() will configure CPACR_ELx.SMEN to trap EL0 accesses to streaming mode SVE registers, so these cannot be accessed directly at EL0. As fpsimd_save_user_state() verifies the live vector length before saving (S)SVE state to memory, no secret values can be saved back to memory (and hence cannot be observed via ptrace, signals, etc). When the live vector length doesn't match the expected vector length for the task, fpsimd_save_user_state() will send a fatal SIGKILL signal to the task. Hence the task may be killed after executing userspace for some period of time. (2) Restoring a context with SVE_SIG_FLAG_SM clear does not clear the task's SVCR.SM. If SVCR.SM was set prior to restoring the context, then the task will be left in streaming mode unexpectedly, and some register state will be combined inconsistently, though the task will be left in legitimate state from the kernel's PoV. This can only occur in unusual (but legitimate) cases where ptrace has been used to set SVCR.SM after entry to the sigreturn syscall, as syscall entry clears SVCR.SM. In these cases, the the provided SVE register data will be loaded into the task's sve_state using the non-streaming SVE vector length and the FPSIMD registers will be merged into this using the streaming SVE vector length. Fix (1) by setting TIF_SME when setting SVCR.SM. This also requires ensuring that the task's sme_state has been allocated, but as this could contain live ZA state, it should not be zeroed. Fix (2) by clearing SVCR.SM when restoring a SVE signal context with SVE_SIG_FLAG_SM clear. For consistency, I've pulled the manipulation of SVCR, TIF_SVE, TIF_SME, and fp_type earlier, immediately after the allocation of sve_state/sme_state, before the restore of the actual register state. This makes it easier to ensure that these are always modified consistently, even if a fault is taken while reading the register data from the signal context. I do not expect any software to depend on the exact state restored when a fault is taken while reading the context.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/7b5a52cf252a0d2e89787b645290ad288878f332
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/9bc3adba8c35119be80ab20217027720446742f2
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/ce820dd4e6e2d711242dc4331713b9bb4fe06d09
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/d2907cbe9ea0a54cbe078076f9d089240ee1e2d9
Impacted products
Vendor Product Version
To clipboard 

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64/fpsimd: signal: Fix restoration of SVE context\n\nWhen SME is supported, Restoring SVE signal context can go wrong in a\nfew ways, including placing the task into an invalid state where the\nkernel may read from out-of-bounds memory (and may potentially take a\nfatal fault) and/or may kill the task with a SIGKILL.\n\n(1) Restoring a context with SVE_SIG_FLAG_SM set can place the task into\n    an invalid state where SVCR.SM is set (and sve_state is non-NULL)\n    but TIF_SME is clear, consequently resuting in out-of-bounds memory\n    reads and/or killing the task with SIGKILL.\n\n    This can only occur in unusual (but legitimate) cases where the SVE\n    signal context has either been modified by userspace or was saved in\n    the context of another task (e.g. as with CRIU), as otherwise the\n    presence of an SVE signal context with SVE_SIG_FLAG_SM implies that\n    TIF_SME is already set.\n\n    While in this state, task_fpsimd_load() will NOT configure SMCR_ELx\n    (leaving some arbitrary value configured in hardware) before\n    restoring SVCR and attempting to restore the streaming mode SVE\n    registers from memory via sve_load_state(). As the value of\n    SMCR_ELx.LEN may be larger than the task\u0027s streaming SVE vector\n    length, this may read memory outside of the task\u0027s allocated\n    sve_state, reading unrelated data and/or triggering a fault.\n\n    While this can result in secrets being loaded into streaming SVE\n    registers, these values are never exposed. As TIF_SME is clear,\n    fpsimd_bind_task_to_cpu() will configure CPACR_ELx.SMEN to trap EL0\n    accesses to streaming mode SVE registers, so these cannot be\n    accessed directly at EL0. As fpsimd_save_user_state() verifies the\n    live vector length before saving (S)SVE state to memory, no secret\n    values can be saved back to memory (and hence cannot be observed via\n    ptrace, signals, etc).\n\n    When the live vector length doesn\u0027t match the expected vector length\n    for the task, fpsimd_save_user_state() will send a fatal SIGKILL\n    signal to the task. Hence the task may be killed after executing\n    userspace for some period of time.\n\n(2) Restoring a context with SVE_SIG_FLAG_SM clear does not clear the\n    task\u0027s SVCR.SM. If SVCR.SM was set prior to restoring the context,\n    then the task will be left in streaming mode unexpectedly, and some\n    register state will be combined inconsistently, though the task will\n    be left in legitimate state from the kernel\u0027s PoV.\n\n    This can only occur in unusual (but legitimate) cases where ptrace\n    has been used to set SVCR.SM after entry to the sigreturn syscall,\n    as syscall entry clears SVCR.SM.\n\n    In these cases, the the provided SVE register data will be loaded\n    into the task\u0027s sve_state using the non-streaming SVE vector length\n    and the FPSIMD registers will be merged into this using the\n    streaming SVE vector length.\n\nFix (1) by setting TIF_SME when setting SVCR.SM. This also requires\nensuring that the task\u0027s sme_state has been allocated, but as this could\ncontain live ZA state, it should not be zeroed. Fix (2) by clearing\nSVCR.SM when restoring a SVE signal context with SVE_SIG_FLAG_SM clear.\n\nFor consistency, I\u0027ve pulled the manipulation of SVCR, TIF_SVE, TIF_SME,\nand fp_type earlier, immediately after the allocation of\nsve_state/sme_state, before the restore of the actual register state.\nThis makes it easier to ensure that these are always modified\nconsistently, even if a fault is taken while reading the register data\nfrom the signal context. I do not expect any software to depend on the\nexact state restored when a fault is taken while reading the context."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:  arm64/fpsimd: se\u00f1al: Correcci\u00f3n de la restauraci\u00f3n del contexto SVE  Cuando SME es compatible, la restauraci\u00f3n del contexto de se\u00f1al SVE puede salir mal de varias maneras, incluyendo colocar la tarea en un estado inv\u00e1lido donde el kernel puede leer de memoria fuera de l\u00edmites (y puede potencialmente sufrir una falla fatal) y/o puede terminar la tarea con un SIGKILL.  (1) Restaurar un contexto con SVE_SIG_FLAG_SM establecido puede colocar la tarea en un estado inv\u00e1lido donde SVCR.SM est\u00e1 establecido (y sve_state no es NULL) pero TIF_SME est\u00e1 despejado, lo que consecuentemente resulta en lecturas de memoria fuera de l\u00edmites y/o la terminaci\u00f3n de la tarea con SIGKILL.  Esto solo puede ocurrir en casos inusuales (pero leg\u00edtimos) donde el contexto de se\u00f1al SVE ha sido modificado por el espacio de usuario o fue guardado en el contexto de otra tarea (p. ej., como con CRIU), ya que de lo contrario la presencia de un contexto de se\u00f1al SVE con SVE_SIG_FLAG_SM implica que TIF_SME ya est\u00e1 establecido.  Mientras en este estado, task_fpsimd_load() NO configurar\u00e1 SMCR_ELx (dejando alg\u00fan valor arbitrario configurado en hardware) antes de restaurar SVCR e intentar restaurar los registros SVE en modo streaming desde la memoria a trav\u00e9s de sve_load_state(). Como el valor de SMCR_ELx.LEN puede ser mayor que la longitud del vector SVE en modo streaming de la tarea, esto puede leer memoria fuera del sve_state asignado a la tarea, leyendo datos no relacionados y/o desencadenando una falla.  Si bien esto puede resultar en la carga de secretos en los registros SVE en modo streaming, estos valores nunca son expuestos. Como TIF_SME est\u00e1 despejado, fpsimd_bind_task_to_cpu() configurar\u00e1 CPACR_ELx.SMEN para atrapar accesos EL0 a los registros SVE en modo streaming, por lo que estos no pueden ser accedidos directamente en EL0. Como fpsimd_save_user_state() verifica la longitud del vector en vivo antes de guardar el estado (S)SVE en memoria, ning\u00fan valor secreto puede ser guardado de nuevo en memoria (y por lo tanto no puede ser observado a trav\u00e9s de ptrace, se\u00f1ales, etc.).  Cuando la longitud del vector en vivo no coincide con la longitud del vector esperada para la tarea, fpsimd_save_user_state() enviar\u00e1 una se\u00f1al SIGKILL fatal a la tarea. Por lo tanto, la tarea puede ser terminada despu\u00e9s de ejecutar el espacio de usuario por alg\u00fan per\u00edodo de tiempo.  (2) Restaurar un contexto con SVE_SIG_FLAG_SM despejado no despeja el SVCR.SM de la tarea. Si SVCR.SM estaba establecido antes de restaurar el contexto, entonces la tarea quedar\u00e1 en modo streaming inesperadamente, y alg\u00fan estado de registro se combinar\u00e1 de manera inconsistente, aunque la tarea quedar\u00e1 en un estado leg\u00edtimo desde el punto de vista del kernel.  Esto solo puede ocurrir en casos inusuales (pero leg\u00edtimos) donde ptrace ha sido usado para establecer SVCR.SM despu\u00e9s de la entrada a la llamada al sistema sigreturn, ya que la entrada a la llamada al sistema despeja SVCR.SM.  En estos casos, los datos de registro SVE proporcionados se cargar\u00e1n en el sve_state de la tarea usando la longitud del vector SVE no-streaming y los registros FPSIMD se fusionar\u00e1n en esto usando la longitud del vector SVE en modo streaming.  Soluci\u00f3n para (1) estableciendo TIF_SME al establecer SVCR.SM. Esto tambi\u00e9n requiere asegurar que el sme_state de la tarea ha sido asignado, pero como esto podr\u00eda contener estado ZA en vivo, no debe ser puesto a cero. Soluci\u00f3n para (2) despejando SVCR.SM al restaurar un contexto de se\u00f1al SVE con SVE_SIG_FLAG_SM despejado.  Para consistencia, he adelantado la manipulaci\u00f3n de SVCR, TIF_SVE, TIF_SME y fp_type, inmediatamente despu\u00e9s de la asignaci\u00f3n de sve_state/sme_state, antes de la restauraci\u00f3n del estado de registro real. Esto facilita asegurar que estos siempre se modifiquen de manera consist"
    }
  ],
  "id": "CVE-2026-23102",
  "lastModified": "2026-02-06T17:16:25.430",
  "metrics": {},
  "published": "2026-02-04T17:16:21.077",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/7b5a52cf252a0d2e89787b645290ad288878f332"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/9bc3adba8c35119be80ab20217027720446742f2"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/ce820dd4e6e2d711242dc4331713b9bb4fe06d09"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/d2907cbe9ea0a54cbe078076f9d089240ee1e2d9"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Awaiting Analysis"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.