CVE-2026-98745: arm64/fpsimd: signal: Forbid non-streaming SVE payload on SME-only systems
arm64/fpsimd: signal: Forbid non-streaming SVE payload on SME-only systems
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.113-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.10-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.56 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.10 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The affected configuration is arm64 hardware where the kernel reports SME support but no SVE support. The issue occurs during restoration of an SVE signal context on those systems.
What malformed signal context triggers the invalid state?
A restored SVE signal context with SVE_SIG_FLAG_SM clear while still containing an SVE payload triggers the issue. This combination should be rejected because a clear streaming-mode flag requires no SVE payload and a recorded vector length of zero.
What can happen after the malformed context is restored?
The task can incorrectly acquire non-streaming SVE state. Later operations on the task's FPSIMD, SVE, or SME state can cause a range of failures, including fatal EL1 undefined-instruction exceptions.
What signal-context forms are valid on SME-only systems?
A valid context either has SVE_SIG_FLAG_SM set with an SVE payload containing streaming-mode SVE state, or has the flag clear with no SVE payload and FPSIMD state in the FPSIMD context. The kernel records the live streaming vector length in the first case and zero in the second.