Linux kernel arm64 SME: fixed 8-byte FFR clear corrupts memory past the SVE context struct

Impact

When saving SVE state in streaming SVE mode the kernel cleared the inaccessible FFR field with an unconditional 8-byte store. With any SME vector length other than 64 bytes the store either leaves the field partly uncleared or writes past the end of a kmalloc'd context structure, which maintainers observed as kfence splats and kmalloc redzone corruption under the fp-stress selftest. That is a local kernel heap write with attacker-influenced timing, so the realistic ceiling is privilege escalation on the host, and the floor is a crash that takes the whole node with it. This only matters on arm64 hosts that actually implement SME; on x86 GPU nodes and on arm64 parts without SME the code path does not exist, so for most fleets this is a no-op. Treat it as a hygiene item for arm64 CPU hosts rather than a reason to open a window tonight.

Who can reach it

Local unprivileged user on an arm64 host whose CPU implements SME - any process that can enter streaming SVE mode and take a signal. No authentication beyond a shell or a container with normal CPU access; not remotely reachable.

What to do

Update to a stable kernel carrying the PFALSE-plus-STR-P fix (four stable branches have it, see the git.kernel.org links) and reboot the affected arm64 nodes. No configuration mitigation is documented; nodes without SME-capable CPUs are not affected and need no action.

References

Related entries

• Linux kernel (net/smc): Closing an SMC socket can leave the internal TCP kernel socket with its timers still armed andCVE-2023-53781 · Linux kernel (net/smc)High
• Linux kernel bpf: reused slab objects leave htab special fields stale, causing hard lockupCVE-2023-53790 · Linux kernel BPF memory allocator (non-preallocated htab map values)High
• Linux kernel (drivers/iommu/iommufd): The destroy ioctl takes a temporary reference on an iommufd object without theCVE-2023-53795 · Linux kernel (drivers/iommu/iommufd)High
• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): A use-after-free in the amdkfd (KFD compute driverCVE-2023-53816 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)High
• Linux kernel bpf/sockmap: SKB refcount race gives use-after-free in the backlog workerCVE-2023-53836 · Linux kernel BPF sockmap (sk_psock_backlog SKB refcount)High
• Linux kernel sched/psi: use-after-free when a cgroup is removed under a poll() on its pressure fileCVE-2023-54019 · Linux kernel sched/psi (cgroup pressure-stall trigger polling)High