Critical Vulnerability in Linux Kernel: KVM FPSIMD/SVE/SME State Management Flaw
Summary
DEBIAN-CVE-2025-22013: In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Unconditionally save+flush host FPSIMD/SVE/SME state There are several problems with the way hyp code lazily saves the host's FPSIMD/SVE sta... Affects linux versions < 6.12.21-1. Fixed in 6.12.21-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware management and system resources. It supports various architectures and is crucial for system stability and performance. This vulnerability affects the KVM (Kernel-based Virtual Machine) component, which allows multiple virtual machines to run on a single physical host. The flaw specifically involves the management of the host's FPSIMD, SVE, and SME states, leading to potential system instability and crashes.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the KVM component related to the management of the host's FPSIMD/SVE/SME state. The issue arises from the lazy saving of these states, which can lead to unexpected behavior, including the discarding of host SVE state and stale memory values. This vulnerability has been traced back to erroneous assumptions made in earlier kernel versions, potentially affecting system stability and causing crashes in virtual machines that utilize these features.
How To Fix
Minimum fixed version
6.12.21-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workarounds have been provided for this vulnerability. It is advisable to apply the patch as soon as it is available to mitigate any risks associated with this issue.
Conclusion
The identified vulnerability in the Linux kernel's KVM component poses significant risks to system stability and virtual machine performance. It is crucial for users to update their systems to the patched version to mitigate these risks. Regular monitoring and prompt updates are essential for maintaining system security.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to system crashes and instability in virtual machines that rely on the FPSIMD/SVE/SME state management.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
The vulnerability affects Linux kernel versions prior to 6.12.21-1 in both Debian 13 and 14.
While the primary concern is system instability and crashes, it is advisable to back up important data as a precaution.
If an immediate update is not possible, monitor your system closely for any unusual behavior and consider isolating affected virtual machines until the patch can be applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
