CVE-2025-0647
In certain Arm CPUs, a CPP RCTX instruction executed on one Processing Element (PE) may inhibit...
CVE-2025-0647 is a high vulnerability (CVSS 7.9) in Arm C1-premium, published January 14, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.17%, the 6th percentile. Fixed in :unknown: SoCVersion:2026-11-05.
- Severity
- 7.9 HighCVSS 3.1, CVE List
- Exploit chance
- 0.17%EPSS, 6th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
SoCVersion:2026-11-05:unknown: +8 more
Description
In certain Arm CPUs, a CPP RCTX instruction executed on one Processing Element (PE) may inhibit TLB invalidation when a TLBI is issued to the PE, either by the same PE or another PE in the shareability domain. In this case, the PE may retain stale TLB entries which should have been invalidated by the TLBI.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
:unknown:Android | SoCVersion:0 up to SoCVersion:2026-11-05, plus listed versions SoCVersion | SoCVersion:2026-11-05 |
arm-trusted-firmwareDebian:12 | All versions, plus listed versions 2.10.0+dfsg-12.10.10+dfsg-12.12.0+dfsg-12.12.0+dfsg-22.12.1+dfsg-1 Show 5 moreShow less2.12.16+dfsg-12.8.0+dfsg-12.9.0+dfsg-12.9.0+dfsg-22.9.0+dfsg-3 | None known |
arm-trusted-firmwareDebian:13 | All versions, plus listed versions 2.12.1+dfsg-12.12.16+dfsg-1 | None known |
arm-trusted-firmwareDebian:14 | before 2.12.16+dfsg-1, plus listed versions 2.12.1+dfsg-1 | 2.12.16+dfsg-1 |
arm-trusted-firmwareUbuntu:20.04:LTS | All versions, plus listed versions 2.1-32.2-2 | None known |
arm-trusted-firmwareUbuntu:22.04:LTS | All versions, plus listed versions 2.5+dfsg-12.6+dfsg-1 | None known |
arm-trusted-firmwareUbuntu:24.04:LTS | All versions, plus listed versions 2.9.0+dfsg-32.10.0+dfsg-12.10.0+dfsg-1build12.10.0+dfsg-1build2 | None known |
arm-trusted-firmwareUbuntu:26.10 | All versions, plus listed versions 2.12.1+dfsg-12.12.1+dfsg-1ubuntu1 | None known |
arm-trusted-firmwareUbuntu:26.04:LTS | All versions, plus listed versions 2.10.0+dfsg-1build22.12.1+dfsg-1 | None known |
What each source reports
CVE List Score used
In certain Arm CPUs, a CPP RCTX instruction executed on one Processing Element (PE) may inhibit TLB invalidation when a TLBI is issued to the PE, either by the same PE or another PE in the shareability domain. In this case, the PE may retain stale TLB entries which should have been invalidated by the TLBI.
- Record
CVE-2025-0647- CVSS 3.1
- 7.9 High
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N - Weakness
- CWE-226
- Updated
- 2026-11-02
EUVDEUVD-2026-2516
In certain Arm CPUs, a CPP RCTX instruction executed on one Processing Element (PE) may inhibit TLB invalidation when a TLBI is issued to the PE, either by the same PE or another PE in the shareability domain. In this case, the PE may retain stale TLB entries which should have been invalidated by the TLBI.
- Record
EUVD-2026-2516- CVSS 3.1
- 7.9 High
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-xxhx-7292-7rv8
In certain Arm CPUs, a CPP RCTX instruction executed on one Processing Element (PE) may inhibit...
In certain Arm CPUs, a CPP RCTX instruction executed on one Processing Element (PE) may inhibit TLB invalidation when a TLBI is issued to the PE, either by the same PE or another PE in the shareability domain. In this case, the PE may retain stale TLB entries which should have been invalidated by the TLBI.
- Record
GHSA-xxhx-7292-7rv8- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-226
- Updated
- 2026-11-02
NVD
In certain Arm CPUs, a CPP RCTX instruction executed on one Processing Element (PE) may inhibit TLB invalidation when a TLBI is issued to the PE, either by the same PE or another PE in the shareability domain. In this case, the PE may retain stale TLB entries which should have been invalidated by the TLBI.
- Record
CVE-2025-0647- CVSS 3.1
- 7.9 High
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N - Weakness
- CWE-226
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2025-0647
In certain Arm CPUs, a CPP RCTX instruction executed on one Processing Element (PE) may inhibit TLB invalidation when a TLBI is issued to the PE, either by the same PE or another PE in the shareability domain. In this case, the PE may retain stale TLB entries which should have been invalidated by the TLBI.
- Record
DEBIAN-CVE-2025-0647- CVSS 3.1
- 7.9 High
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-0647
(In certain Arm CPUs, a CPP RCTX instruction executed on one Processing ...)
- Record
UBUNTU-CVE-2025-0647- CVSS 3.1
- 7.9 High
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N - Updated
- 2026-11-10
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
developer.arm.com/documentation/111546
graph.volerion.com/view?ID=CVE-2025-0647
nvd.nist.gov/vuln/detail/CVE-2025-0647
github.com/advisories/GHSA-xxhx-7292-7rv8
source.android.com/security/bulletin/2026-11-01
security-tracker.debian.org/tracker/CVE-2025-0647
ubuntu.com/security/CVE-2025-0647
cve.org/CVERecord?id=CVE-2025-0647
support.arm.com/documentation/111546/latest