Linux kernel arm64: MOPS exception handler reads a source register for SET*, going out of bounds on XZR

Impact

do_el0_mops() read the source register field from the ESR even for SET* instructions, which do not use one. When the MOPS exception is taken from a SET* sequence using XZR, that field is reported as register 31 and the handler indexes past the end of the pt_regs register array - the only architectural case where the field can be 31. The exposure is an out-of-bounds read of kernel memory adjacent to pt_regs, reachable by any local unprivileged process on an arm64 host that executes such a sequence; the record does not establish a path to code execution or to usable disclosure. Relevant to arm64 GPU nodes (Grace-class hosts) and only to kernels after commit 2de451a329cf, which removed the pt_regs_read_reg() bounds check that made the earlier code benign.

Who can reach it

Local, unprivileged. Any user able to run code on the arm64 host - including a tenant inside a container, since no capability or device access is needed - can execute a SET* sequence with XZR as the source and take an MOPS exception. Not reachable remotely and not reachable at all on x86 nodes.

What to do

Update to a stable kernel carrying the fix (the source register is no longer dereferenced for a set operation) and reboot the node; kernels predating commit 2de451a329cf are not affected, so check before scheduling the window. The references list the stable commits; no vendor advisory names a single fixed release.

References

Related entries

• Linux i40e: empty MAC filter list dereferences an invalid list entryCVE-2025-39853 · Linux kernel i40e driver (MAC filter list handling)High
• Linux kernel i40e: out-of-bounds read through the netdev_ops debugfs fileCVE-2025-39901 · Linux kernel i40e driver (netdev_ops debugfs file)High
• Linux kernel (arch/x86/kvm/svm): On AMD hosts that cannot report the next RIP, KVM's WRMSR/HLT/INVD fastpath has toCVE-2025-40038 · Linux kernel (arch/x86/kvm/svm)High
• VMware ESXi / Workstation / Tools: Uninitialised memory in vSockets discloses host memory to the guestCVE-2025-41239 · VMware ESXi / Workstation / ToolsHigh
• Linux crypto/iaa: out-of-bounds compression-mode index when no slot is freeCVE-2025-71231 · Linux kernel crypto/iaa driver (Intel In-Memory Analytics Accelerator compression modes)High
• Firecracker: failed memory remap lets a guest root user read or modify VMM process memoryCVE-2026-122192 · Firecracker VMM (balloon / virtio-mem discard on File-backend snapshot restore)High