CVE-2026-23114: arm64/fpsimd: ptrace: Fix SVE writes on !SME systems

Published Feb 14, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

arm64/fpsimd: ptrace: Fix SVE writes on !SME systems

When SVE is supported but SME is not supported, a ptrace write to the NTARMSVE regset can place the tracee into an invalid state where (non-streaming) SVE register data is stored in FPSTATESVE format but TIFSVE is clear. This can result in a later warning from fpsimdrestorecurrentstate(), e.g.

WARNING: CPU: 0 PID: 7214 at arch/arm64/kernel/fpsimd.c:383 fpsimdrestorecurrentstate+0x50c/0x748

When this happens, fpsimdrestorecurrentstate() will set TIFSVE, placing the task into the correct state. This occurs before any other check of TIFSVE can possibly occur, as other checks of TIFSVE only happen while the FPSIMD/SVE/SME state is live. Thus, aside from the warning, there is no functional issue.

This bug was introduced during rework to error handling in commit:

9f8bf718f2923 ("arm64/fpsimd: ptrace: Gracefully handle errors")

... where the setting of TIFSVE was moved into a block which is only executed when systemsupportssme() is true.

Fix this by removing the systemsupportssme() check. This ensures that TIFSVE is set for (SVE-formatted) writes to NTARMSVE, at the cost of unconditionally manipulating the tracee's saved svcr value. The manipulation of svcr is benign and inexpensive, and we already do similar elsewhere (e.g. during signal handling), so I don't think it's worth guarding this with systemsupportssme() checks.

Aside from the above, there is no functional change. The 'type' argument to svesetcommon() is only set to ARM64VECSME (in ssveset())) when systemsupportssme(), so the ARM64VECSME case in the switch statement is still unreachable when !systemsupportssme(). When CONFIGARM64SME=n, the only caller of svesetcommon() is sveset(), and the compiler can constant-fold for the case where type is ARM64VECSVE, removing the logic for other cases.

Affected Software

8 affected components
Linux Linux kernel
Linux Linux kernel>=6.16<6.18.8
Linux Linux kernel=6.19-rc1
Linux Linux kernel=6.19-rc2
Linux Linux kernel=6.19-rc3
Linux Linux kernel=6.19-rc4
Linux Linux kernel=6.19-rc5
Linux Linux kernel=6.19-rc6

Event History

Feb 14, 2026
CVE Published
via MITRE·03:09 PM
Data Sourced
via MITRE·03:09 PM
Description
Data Sourced
via NVD·03:16 PM
RemedyDescriptionSeverityAffected Software

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203