Technical impact
An issue exists in Arm C1-Pro firmware before r1p2‑50eac0. During particular operations, the combination of a TLBI (TLB Invalidate) followed by a DSB (Data Synchronization Barrier) may fail to guarantee that all SME (Scalable Matrix Extension) memory accesses are completed before the next instruction. The failure could leave SME data in an incomplete or inconsistent state, potentially leading to data corruption or unpredictable system behavior. This vulnerability is characterized as a race condition (CWE‑362). The likely attack vector, inferred from the description, could involve manipulating SME access patterns under the compromised timing conditions, but a publicly documented exploit or remote entry point is not provided.
Affected Systems
The Arm C1‑Pro processor, specifically firmware versions prior to r1p2‑50eac0, is affected. No additional product or version details are supplied in the source data.
Risk and Exploitability
The CVSS score of 3.6 indicates limited impact, and the EPSS score of less than 1% reflects a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread attacks. The most probable exploitation scenario would require very specific hardware timing conditions and likely an insider or privileged attacker manipulating SME memory accesses, which reduces its overall risk to typical operational environments.
