CVE-2023-53713

arm64: sme: Use STR P to clear FFR context field in streaming SVE mode

7.8 HighFix available

In the Linux kernel, the following vulnerability has been resolved:

arm64: sme: Use STR P to clear FFR context field in streaming SVE mode

The FFR is a predicate register which can vary between 16 and 256 bits in size depending upon the configured vector length. When saving the SVE state in streaming SVE mode, the FFR register is inaccessible and so commit 9f5848665788 ("arm64/sve: Make access to FFR optional") simply clears the FFR field of the in-memory context structure. Unfortunately, it achieves this using an unconditional 8-byte store and so if the SME vector length is anything other than 64 bytes in size we will either fail to clear the entire field or, worse, we will corrupt memory immediately following the structure. This has led to intermittent kfence splats in CI [1] and can trigger kmalloc Redzone corruption messages when running the 'fp-stress' kselftest:

| =============================================================================

| BUG kmalloc-1k (Not tainted): kmalloc Redzone overwritten | ----------------------------------------------------------------------------- | | 0xffff000809bf1e22-0xffff000809bf1e27 @offset=7714. First byte 0x0 instead of 0xcc | Allocated in do_sme_acc+0x9c/0x220 age=2613 cpu=1 pid=531 | __kmalloc+0x8c/0xcc | do_sme_acc+0x9c/0x220 | ...

Replace the 8-byte store with a store of a predicate register which has been zero-initialised with PFALSE, ensuring that the entire field is cleared in memory.

[1] https://lore.kernel.org/r/CA+G9fYtU7HsV0R0dp4XEH5xXHSJFw8KyDf5VQrLLfMxWfxQkag@mail.gmail.com

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.16%Up 0.1 points since Oct 23, 2025

What each source reports

CVE List Score used7.8

arm64: sme: Use STR P to clear FFR context field in streaming SVE mode

In the Linux kernel, the following vulnerability has been resolved:

arm64: sme: Use STR P to clear FFR context field in streaming SVE mode

| =============================================================================

Replace the 8-byte store with a store of a predicate register which has been zero-initialised with PFALSE, ensuring that the entire field is cleared in memory.

[1] https://lore.kernel.org/r/CA+G9fYtU7HsV0R0dp4XEH5xXHSJFw8KyDf5VQrLLfMxWfxQkag@mail.gmail.com

Record: CVE-2023-53713
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

EUVDEUVD-2023-600157.8

In the Linux kernel, the following vulnerability has been resolved:

arm64: sme: Use STR P to clear FFR context field in streaming SVE mode

| =============================================================================

Replace the 8-byte store with a store of a predicate register which has been zero-initialised with PFALSE, ensuring that the entire field is cleared in memory.

[1] https://lore.kernel.org/r/CA+G9fYtU7HsV0R0dp4XEH5xXHSJFw8KyDf5VQrLLfMxWfxQkag@mail.gmail.com

Record: EUVD-2023-60015
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-f5qp-mjwc-27gf7.8

In the Linux kernel, the following vulnerability has been resolved: arm64: sme: Use STR P to...

In the Linux kernel, the following vulnerability has been resolved:

arm64: sme: Use STR P to clear FFR context field in streaming SVE mode

| =============================================================================

Replace the 8-byte store with a store of a predicate register which has been zero-initialised with PFALSE, ensuring that the entire field is cleared in memory.

[1] https://lore.kernel.org/r/CA+G9fYtU7HsV0R0dp4XEH5xXHSJFw8KyDf5VQrLLfMxWfxQkag@mail.gmail.com

Record: GHSA-f5qp-mjwc-27gf
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

NVD7.8

In the Linux kernel, the following vulnerability has been resolved:

arm64: sme: Use STR P to clear FFR context field in streaming SVE mode

| =============================================================================

Replace the 8-byte store with a store of a predicate register which has been zero-initialised with PFALSE, ensuring that the entire field is cleared in memory.

[1] https://lore.kernel.org/r/CA+G9fYtU7HsV0R0dp4XEH5xXHSJFw8KyDf5VQrLLfMxWfxQkag@mail.gmail.com

Record: CVE-2023-53713
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVBELL-CVE-2023-537137.8

Record: BELL-CVE-2023-53713
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSV7.8

arm64: sme: Use STR P to clear FFR context field in streaming SVE mode

In the Linux kernel, the following vulnerability has been resolved:

arm64: sme: Use STR P to clear FFR context field in streaming SVE mode

| =============================================================================

Replace the 8-byte store with a store of a predicate register which has been zero-initialised with PFALSE, ensuring that the entire field is cleared in memory.

[1] https://lore.kernel.org/r/CA+G9fYtU7HsV0R0dp4XEH5xXHSJFw8KyDf5VQrLLfMxWfxQkag@mail.gmail.com

Record: CVE-2023-53713
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 14 moreShow less

OSVDEBIAN-CVE-2023-537137.8

In the Linux kernel, the following vulnerability has been resolved: arm64: sme: Use STR P to clear FFR context field in streaming SVE mode The FFR is a predicate register which can vary between 16 and 256 bits in size depending upon the configured vector length. When saving the SVE state in streaming SVE mode, the FFR register is inaccessible and so commit 9f5848665788 ("arm64/sve: Make access to FFR optional") simply clears the FFR field of the in-memory context structure. Unfortunately, it achieves this using an unconditional 8-byte store and so if the SME vector length is anything other than 64 bytes in size we will either fail to clear the entire field or, worse, we will corrupt memory immediately following the structure. This has led to intermittent kfence splats in CI [1] and can trigger kmalloc Redzone corruption messages when running the 'fp-stress' kselftest: | ============================================================================= | BUG kmalloc-1k (Not tainted): kmalloc Redzone overwritten | ----------------------------------------------------------------------------- | | 0xffff000809bf1e22-0xffff000809bf1e27 @offset=7714. First byte 0x0 instead of 0xcc | Allocated in do_sme_acc+0x9c/0x220 age=2613 cpu=1 pid=531 | __kmalloc+0x8c/0xcc | do_sme_acc+0x9c/0x220 | ... Replace the 8-byte store with a store of a predicate register which has been zero-initialised with PFALSE, ensuring that the entire field is cleared in memory. [1] https://lore.kernel.org/r/CA+G9fYtU7HsV0R0dp4XEH5xXHSJFw8KyDf5VQrLLfMxWfxQkag@mail.gmail.com

Record: DEBIAN-CVE-2023-53713
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2024:23947.8

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Record: RHSA-2024:2394
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2023-537137.8

Record: UBUNTU-CVE-2023-53713
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVCLSA-2025-1765463110No score

kernel: Fix of 45 CVEs

Bluetooth: MGMT: Protect mgmt_pending list with its own lock {CVE-2025-38117}
padata: Fix pd UAF once and for all {CVE-2025-38584}
wifi: cfg80211: Fix use after free for wext {CVE-2023-53153}
padata: Fix list iterator in padata_do_serial()
padata: do not leak refcount in reorder_work {CVE-2025-38031}
padata: avoid UAF for reorder_work {CVE-2025-21726}
padata: add pd get/put refcnt helper
net/smc: fix UAF on smcsk after smc_listen_out() {CVE-2025-38734}
scsi: mpi3mr: Bad drive in topology results kernel crash {CVE-2023-53037}
scsi: mpi3mr: Driver unload crashes host when enhanced logging is enabled
wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() {CVE-2022-50258}
igb: Fix igb_down hung on surprise removal {CVE-2023-53148}
drm/i915/sseu: fix max_subslices array-index-out-of-bounds access {CVE-2023-53112}
i40e: fix idx validation in config queues msg {CVE-2025-39971}
dm-bufio: don't schedule in atomic context {CVE-2025-37928}
fs: prevent out-of-bounds array speculation when closing a file descriptor {CVE-2023-53117}
vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint {CVE-2025-22083}
iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid {CVE-2025-37927}
tracing: Fix oob write in trace_seq_to_buffer() {CVE-2025-37923}
KVM: x86: Reset IRTE to host control if new route isn't postable {CVE-2025-37885}
KVM: arm64: Tear down vGIC on failed vCPU creation {CVE-2025-37849}
KVM: Reject attempts to consume or refresh inactive gfn_to_pfn_cache {CVE-2022-49882}
jbd2: remove wrong sb->s_sequence check {CVE-2025-37839}
power: supply: gpio-charger: Fix set charge current limits {CVE-2024-57792}
ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object {CVE-2024-46798}
ipv6: prevent possible UAF in ip6_xmit() {CVE-2024-44985}
ipv6: fix possible UAF in ip6_finish_output2() {CVE-2024-44986}
netfilter: flowtable: validate vlan header {CVE-2024-44983}
usb: typec: fix potential out of bounds in ucsi_ccg_update_set_new_cam_cmd() {CVE-2024-50268}
usb: vhci-hcd: Do not drop references before new references are gained {CVE-2024-43883}
drm/amd/display: Fix slab-use-after-free on hdcp_work {CVE-2025-21968}
drm/amd/display: Check num_valid_sets before accessing reader_wm_sets[] {CVE-2024-46815}
drm/amd/display: Check index msg_id before read or write {CVE-2024-42121}
drm/amd/display: Check pipe offset before setting vblank {CVE-2024-42120}
drm/amdkfd: don't allow mapping the MMIO HDP page with large pages {CVE-2024-41011}
drm/amdkfd: Fix an illegal memory access {CVE-2023-53090}
drm/shmem-helper: Remove another errant put in error path {CVE-2023-53084}
drm/amd/display: fix shift-out-of-bounds in CalculateVMAndRowBytes {CVE-2023-53077}
drm/i915: mark requests for GuC virtual engines to avoid use-after-free {CVE-2023-53552}
ptp: fix integer overflow in max_vclocks_store {CVE-2024-40994}
nvmet: avoid potential UAF in nvmet_req_complete() {CVE-2023-53116}
loop: Fix use-after-free issues {CVE-2023-53111}
ftrace: Fix invalid address access in lookup_rec() when index is 0 {CVE-2023-53075}
mptcp: use the workqueue to destroy unaccepted sockets {CVE-2023-53072}
perf/core: Fix perf_output_begin parameter is incorrectly invoked in perf_event_bpf_output {CVE-2023-53065}
erspan: do not use skb_mac_header() in ndo_start_xmit() {CVE-2023-53053}
HID: intel-ish-hid: ipc: Fix potential use-after-free in work function {CVE-2023-53039}
netlink: prevent potential spectre v1 gadgets {CVE-2023-53000}
coresight: Clear the connection field properly {CVE-2022-50214}
Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition {CVE-2023-53145}
Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync {CVE-2025-39982}
x86/tdx: Fix "in-kernel MMIO" check {CVE-2024-47727}
arm64: sme: Use STR P to clear FFR context field in streaming SVE mode {CVE-2023-53713}
wifi: mt76: mt7921: fix error code of return in…

Record: CLSA-2025-1765463110
Updated: 2026-11-02

OSVSUSE-SU-2025:21040-1No score