Answer in brief
CVE-2025-22013 records a High severity (CVSS 7.3) vulnerability in KVM: arm64: Unconditionally save+flush host FPSIMD/SVE/SME state. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Product | Affected versions | Fixed versions |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:* | Not reported | Not reported |
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=c4ab60a86c5ed7c0d727c6dc8cec352e16bc7f90 <5289ac43b69c61a49c75720921f2008005a31c43 || >=d5f7d3833b534f9e43e548461dba1e60aa82f587 <04c50cc23a492c4d43fdaefc7c1ecc0ff6f7b82e || >=93ae6b01bafee8fa385aa25ee7ebdb40057f6abe <806d5c1e1d2e5502175a24bf70f251648d99c36a || >=93ae6b01bafee8fa385aa25ee7ebdb40057f6abe <79e140bba70bcacc5fe15bf8c0b958793fd7d56f || >=93ae6b01bafee8fa385aa25ee7ebdb40057f6abe <900b444be493b7f404898c785d6605b177a093d0 || >=93ae6b01bafee8fa385aa25ee7ebdb40057f6abe <fbc7e61195e23f744814e78524b73b59faa54ab4 | 5289ac43b69c61a49c75720921f2008005a31c43, 04c50cc23a492c4d43fdaefc7c1ecc0ff6f7b82e, 806d5c1e1d2e5502175a24bf70f251648d99c36a, 79e140bba70bcacc5fe15bf8c0b958793fd7d56f, 900b444be493b7f404898c785d6605b177a093d0, fbc7e61195e23f744814e78524b73b59faa54ab4 |
| Linux/Linuxgeneric | 6.2 | Not reported |
Published upstream
Apr 8, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Unconditionally save+flush host FPSIMD/SVE/SME state There are several problems with the way hyp code lazily saves the host's FPSIMD/SVE state, including: * Host SVE being discarded unexpectedly due to inconsistent configuration of TIF_SVE and CPACR_ELx.ZEN. This has been seen to result in QEMU crashes where SVE is used by memmove(), as reported by Eric Auger: https://issues.redhat.com/browse/RHEL-68997 * Host SVE state is discarded *after* modification by ptrace, which was an unintentional ptrace ABI change introduced with lazy discarding of SVE state. * The host FPMR value can be discarded when running a non-protected VM, where FPMR support is not exposed to a VM, and that VM uses FPSIMD/SVE. In these cases the hyp code does not save the host's FPMR before unbinding the host's FPSIMD/SVE/SME state, leaving a stale value in memory. Avoid these by eagerly saving and "flushing" the host's FPSIMD/SVE/SME state when loading a vCPU such that KVM does not need to save any of the host's FPSIMD/SVE/SME state. For clarity, fpsimd_kvm_prepare() is removed and the necessary call to fpsimd_save_and_flush_cpu_state() is placed in kvm_arch_vcpu_load_fp(). As 'fpsimd_state' and 'fpmr_ptr' should not be used, they are set to NULL; all uses of these will be removed in subsequent patches. Historical problems go back at least as far as v5.17, e.g. erroneous assumptions about TIF_SVE being clear in commit: 8383741ab2e773a9 ("KVM: arm64: Get rid of host SVE tracking/saving") ... and so this eager save+flush probably needs to be backported to ALL stable trees.
Quoted source text, attributed separately from HOL analysis.