CVE-2025-38670 (GCVE-0-2025-38670)
Vulnerability from cvelistv5
Published
2025-08-22 16:03
Modified
2026-08-05 12:03
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack() `cpu_switch_to()` and `call_on_irq_stack()` manipulate SP to change to different stacks along with the Shadow Call Stack if it is enabled. Those two stack changes cannot be done atomically and both functions can be interrupted by SErrors or Debug Exceptions which, though unlikely, is very much broken : if interrupted, we can end up with mismatched stacks and Shadow Call Stack leading to clobbered stacks. In `cpu_switch_to()`, it can happen when SP_EL0 points to the new task, but x18 stills points to the old task's SCS. When the interrupt handler tries to save the task's SCS pointer, it will save the old task SCS pointer (x18) into the new task struct (pointed to by SP_EL0), clobbering it. In `call_on_irq_stack()`, it can happen when switching from the task stack to the IRQ stack and when switching back. In both cases, we can be interrupted when the SCS pointer points to the IRQ SCS, but SP points to the task stack. The nested interrupt handler pushes its return addresses on the IRQ SCS. It then detects that SP points to the task stack, calls `call_on_irq_stack()` and clobbers the task SCS pointer with the IRQ SCS pointer, which it will also use ! This leads to tasks returning to addresses on the wrong SCS, or even on the IRQ SCS, triggering kernel panics via CONFIG_VMAP_STACK or FPAC if enabled. This is possible on a default config, but unlikely. However, when enabling CONFIG_ARM64_PSEUDO_NMI, DAIF is unmasked and instead the GIC is responsible for filtering what interrupts the CPU should receive based on priority. Given the goal of emulating NMIs, pseudo-NMIs can be received by the CPU even in `cpu_switch_to()` and `call_on_irq_stack()`, possibly *very* frequently depending on the system configuration and workload, leading to unpredictable kernel panics. Completely mask DAIF in `cpu_switch_to()` and restore it when returning. Do the same in `call_on_irq_stack()`, but restore and mask around the branch. Mask DAIF even if CONFIG_SHADOW_CALL_STACK is not enabled for consistency of behaviour between all configurations. Introduce and use an assembly macro for saving and masking DAIF, as the existing one saves but only masks IF.
References
Impacted products
Vendor Product Version
Linux Linux Version: 3f225f29c69c13ce1cbdb1d607a42efeef080056
Version: 402d2b1d54b7085d0c3bfd01fd50c2701dde64b3
Version: 4403c7b7e5e1ad09a266b6e399fd7bf97931508e
Version: 59b37fe52f49955791a460752c37145f1afdcad1
Version: 59b37fe52f49955791a460752c37145f1afdcad1
Version: 59b37fe52f49955791a460752c37145f1afdcad1
Version: 59b37fe52f49955791a460752c37145f1afdcad1
Version: e47ce4f11e26fa3ea99b09521da8b3ac3a7b578d
Version: 5.10.180   ≤
Version: 5.15.111   ≤
Version: 6.1.28   ≤
Version: 6.2.15   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:40:56.025Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC CN 4100",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V5.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T12:05:16.720Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/include/asm/assembler.h",
            "arch/arm64/kernel/entry.S"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f7e0231eeaa33245c649fac0303cf97209605446",
              "status": "affected",
              "version": "3f225f29c69c13ce1cbdb1d607a42efeef080056",
              "versionType": "git"
            },
            {
              "lessThan": "407047893a64399f2d2390ff35cc6061107d805d",
              "status": "affected",
              "version": "402d2b1d54b7085d0c3bfd01fd50c2701dde64b3",
              "versionType": "git"
            },
            {
              "lessThan": "a6b0cb523eaa01efe8a3f76ced493ba60674c6e6",
              "status": "affected",
              "version": "4403c7b7e5e1ad09a266b6e399fd7bf97931508e",
              "versionType": "git"
            },
            {
              "lessThan": "9433a5f437b0948d6a2d8a02ad7a42ab7ca27a61",
              "status": "affected",
              "version": "59b37fe52f49955791a460752c37145f1afdcad1",
              "versionType": "git"
            },
            {
              "lessThan": "708fd522b86d2a9544c34ec6a86fa3fc23336525",
              "status": "affected",
              "version": "59b37fe52f49955791a460752c37145f1afdcad1",
              "versionType": "git"
            },
            {
              "lessThan": "0f67015d72627bad72da3c2084352e0aa134416b",
              "status": "affected",
              "version": "59b37fe52f49955791a460752c37145f1afdcad1",
              "versionType": "git"
            },
            {
              "lessThan": "d42e6c20de6192f8e4ab4cf10be8c694ef27e8cb",
              "status": "affected",
              "version": "59b37fe52f49955791a460752c37145f1afdcad1",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e47ce4f11e26fa3ea99b09521da8b3ac3a7b578d",
              "versionType": "git"
            },
            {
              "lessThan": "5.10.210",
              "status": "affected",
              "version": "5.10.180",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.190",
              "status": "affected",
              "version": "5.15.111",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.149",
              "status": "affected",
              "version": "6.1.28",
              "versionType": "semver"
            },
            {
              "lessThan": "6.3",
              "status": "affected",
              "version": "6.2.15",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/include/asm/assembler.h",
            "arch/arm64/kernel/entry.S"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.190",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.149",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.41",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.210",
                  "versionStartIncluding": "5.10.180",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.190",
                  "versionStartIncluding": "5.15.111",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.149",
                  "versionStartIncluding": "6.1.28",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.101",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.41",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.9",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.2.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack()\n\n`cpu_switch_to()` and `call_on_irq_stack()` manipulate SP to change\nto different stacks along with the Shadow Call Stack if it is enabled.\nThose two stack changes cannot be done atomically and both functions\ncan be interrupted by SErrors or Debug Exceptions which, though unlikely,\nis very much broken : if interrupted, we can end up with mismatched stacks\nand Shadow Call Stack leading to clobbered stacks.\n\nIn `cpu_switch_to()`, it can happen when SP_EL0 points to the new task,\nbut x18 stills points to the old task\u0027s SCS. When the interrupt handler\ntries to save the task\u0027s SCS pointer, it will save the old task\nSCS pointer (x18) into the new task struct (pointed to by SP_EL0),\nclobbering it.\n\nIn `call_on_irq_stack()`, it can happen when switching from the task stack\nto the IRQ stack and when switching back. In both cases, we can be\ninterrupted when the SCS pointer points to the IRQ SCS, but SP points to\nthe task stack. The nested interrupt handler pushes its return addresses\non the IRQ SCS. It then detects that SP points to the task stack,\ncalls `call_on_irq_stack()` and clobbers the task SCS pointer with\nthe IRQ SCS pointer, which it will also use !\n\nThis leads to tasks returning to addresses on the wrong SCS,\nor even on the IRQ SCS, triggering kernel panics via CONFIG_VMAP_STACK\nor FPAC if enabled.\n\nThis is possible on a default config, but unlikely.\nHowever, when enabling CONFIG_ARM64_PSEUDO_NMI, DAIF is unmasked and\ninstead the GIC is responsible for filtering what interrupts the CPU\nshould receive based on priority.\nGiven the goal of emulating NMIs, pseudo-NMIs can be received by the CPU\neven in `cpu_switch_to()` and `call_on_irq_stack()`, possibly *very*\nfrequently depending on the system configuration and workload, leading\nto unpredictable kernel panics.\n\nCompletely mask DAIF in `cpu_switch_to()` and restore it when returning.\nDo the same in `call_on_irq_stack()`, but restore and mask around\nthe branch.\nMask DAIF even if CONFIG_SHADOW_CALL_STACK is not enabled for consistency\nof behaviour between all configurations.\n\nIntroduce and use an assembly macro for saving and masking DAIF,\nas the existing one saves but only masks IF."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable window is in arm64 low-level entry code (`cpu_switch_to()`, `call_on_irq_stack()`) reached only by executing on the CPU \u2014 forcing context switches and taking interrupts/NMIs \u2014 which requires local code execution. No remote protocol data reaches this path; network traffic only produces normal-priority IRQs that are masked in the window.\nAC:L - An unprivileged task controls both sides: it can drive millions of context switches per second (pinned yield/futex ping-pong loops) to hit the ~20-instruction window continuously, while generating the interrupting side itself via high-frequency `perf_event_open()` sampling, whose PMU overflow IRQ is registered as a pseudo-NMI and is therefore delivered even with interrupts \"disabled\". The affected configurations (`CONFIG_SHADOW_CALL_STACK`, `CONFIG_ARM64_PSEUDO_NMI`) are default in Android GKI/ChromeOS and cloud arm64 kernels, not rare, and the commit itself notes the fault can occur \"*very* frequently\" under such configs.\nPR:L - Any unprivileged local user can trigger the code path \u2014 scheduling and interrupt handling need no capability at all \u2014 and unprivileged per-task perf sampling is permitted at the default `perf_event_paranoid=2`. No CAP_SYS_ADMIN, CAP_PERFMON, or root is required to reach or hammer the race.\nUI:N - The attacker\u0027s own threads generate both the context-switch storm and the NMI/exception source; no victim must open a file, mount anything, or run any application. Corruption of an unrelated task\u0027s shadow call stack happens as a side effect of normal scheduler operation.\nS:U - The clobbered shadow call stack pointer, corrupted `task_struct.scs_sp`, and resulting bad returns all occur within the kernel\u0027s own security authority on the same host. No VM, hypervisor, or IOMMU boundary is crossed.\nC:H - The race corrupts control-flow metadata across tasks \u2014 one task\u0027s `ret` sequence consumes another task\u0027s or the IRQ shadow stack \u2014 so execution resumes at a stale kernel return address while SP still refers to a mismatched frame, causing the kernel to interpret unrelated stack contents that can be copied back to userspace via the hijacked path. Defeating the SCS hardening and gaining control over which kernel code runs with foreign stack state is leverageable for kernel memory disclosure.\nI:H - This is genuine memory corruption: a pointer into a foreign shadow stack is written into another task\u0027s `task_struct`, return addresses are pushed into a shadow stack that belongs to a different context, and the victim task then returns to an address it never called. The commit states the wrong-SCS return only panics \"via CONFIG_VMAP_STACK or FPAC if enabled\", so on kernels without those hardenings the corrupted control flow proceeds \u2014 a control-flow hijack primitive whose targeted return addresses the attacker influences by choosing which syscalls populate the shadow stacks.\nA:H - The documented, observed outcome is \"unpredictable kernel panics\" \u2014 VMAP_STACK guard-page faults or FPAC aborts from returning onto the wrong shadow call stack \u2014 which is a full system crash. The condition was serious enough to warrant a stable backport across five stable trees after being reported as spontaneous panics on production arm64 systems."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:03:51.464Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f7e0231eeaa33245c649fac0303cf97209605446"
        },
        {
          "url": "https://git.kernel.org/stable/c/407047893a64399f2d2390ff35cc6061107d805d"
        },
        {
          "url": "https://git.kernel.org/stable/c/a6b0cb523eaa01efe8a3f76ced493ba60674c6e6"
        },
        {
          "url": "https://git.kernel.org/stable/c/9433a5f437b0948d6a2d8a02ad7a42ab7ca27a61"
        },
        {
          "url": "https://git.kernel.org/stable/c/708fd522b86d2a9544c34ec6a86fa3fc23336525"
        },
        {
          "url": "https://git.kernel.org/stable/c/0f67015d72627bad72da3c2084352e0aa134416b"
        },
        {
          "url": "https://git.kernel.org/stable/c/d42e6c20de6192f8e4ab4cf10be8c694ef27e8cb"
        }
      ],
      "title": "arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38670",
    "datePublished": "2025-08-22T16:03:01.242Z",
    "dateReserved": "2025-04-16T04:51:24.031Z",
    "dateUpdated": "2026-08-05T12:03:51.464Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.