arm64/fpsimd: signal: Forbid non-streaming SVE payload on SME-only systems
In the Linux kernel, the following vulnerability has been resolved: arm64/fpsimd: signal: Forbid non-streaming SVE payload on SME-only systems When system_supports_sme() is true but system_supports_sve() is false, restoring a specifically crafted SVE signal context can result in the task erroneously having non-streaming SVE state. Subsequent attempts to manipulate the task's FPSIMD/SVE/SME state can result in a variety of problems, including fatal EL1 UNDEFs. In such configurations, the kernel always creates an SVE signal context when delivering a signal, and this can only be in one of two states: (1) SVE_SIG_FLAG_SM is set, and an SVE payload is present containing streaming mode SVE state. The recorded VL is the task's live streaming VL. (2) SVE_SIG_FLAG_SM is clear, and an SVE payload is not present. The FPSIMD context contains the non-streaming mode FPSIMD state. The recorded VL is 0. Currently restore_sve_fpsimd_context() correctly rejects cases where SVE_SIG_FLAG_SM is set and an SVE payload is not present, but fails to reject cases where SVE_SIG_FLAG_SM is clear and an SVE payload is present. Consequently, restore_sve_fpsimd_context() can place the task in a state where it has non-streaming SVE state even when this is not supported by HW. For example, this can cause a later EL1 UNDEF when the kernel attempts to restore the task's ZCR_EL1 value: | # ./sme-sigcontext-to-sve | Internal error: Oops - Undefined instruction: 0000000002000000 [#1] SMP | Modules linked in: | CP
CVE-2026-98745
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-98745
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "7dde62f0687c8856b6c0660066c7ee83a6a6f033",
"lessThan": "052acee9880114879b5c221fc8dad69b786d0938",
"versionType": "git"
},
{
"status": "affected",
"version": "7dde62f0687c8856b6c0660066c7ee83a6a6f033",
"lessThan": "f2338929c7663859c0c74dd6fef2c0245066f845",
"versionType": "git"
},
{
"status": "affected",
"version": "7dde62f0687c8856b6c0660066c7ee83a6a6f033",
"lessThan": "2bce6f006cfe0b60e8249fd8d51396d99355cba3",
"versionType": "git"
},
{
"status": "affected",
"version": "7dde62f0687c8856b6c0660066c7ee83a6a6f033",
"lessThan": "88c1c611552b24658eb61244086691c02be2013b",
"versionType": "git"
},
{
"status": "affected",
"version": "7dde62f0687c8856b6c0660066c7ee83a6a6f033",
"lessThan": "e060d9069b49fe55f38057dfe592068014652671",
"versionType": "git"
},
{
"status": "affected",
"version": "05458ee3ff82b31a4564836a84ef20d6c233dfc7",
"versionType": "git"
},
{
"status": "affected",
"version": "6.1.7",
"lessThan": "6.2",
"versionType": "semver"
}
],
"programFiles": [
"arch/arm64/kernel/signal.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.2",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.56",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.10",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"arch/arm64/kernel/signal.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-98745
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #48943 · Revision 1
- Added to Heist Feed
- Publisher date