When the Linux kernel restores an ARM SVE signal context on signal return, a missing synchronization between the task’s SME flag and the context’s SVE flag can cause the kernel to read memory beyond the bounds of the allocated SVE state or to terminate the process with a fatal SIGKILL. The bug also leaves a task in an inconsistent streaming mode if the context flag is cleared while an older state remains set. The vulnerability is triggered only when a process is restored from a manipulated or stale SVE context, such as via ptrace, CRIU, or a crafted signal return. Although any data read into the SVE registers is not exposed to user space, the failure may crash or kill legitimate processes, resulting in a denial of service for the affected user or process.

Linux kernel implementations that support SME/SVE, specifically versions that had not yet incorporated the fix – this includes kernel 6.19 release candidates 1 through 6 and any builds that enable SME/SVE before the kernel is rolled forward to the patched state. The fix is included in kernel 6.19‑rc7 and later releases.

The CVSS score of 7.1 indicates a high severity local vulnerability, but the EPSS score of less than 1% suggests exploitation is currently unlikely. The bug requires an attacker to have the ability to manipulate a process’s signal context, which generally implies local or privileged access. No remote code execution or privilege escalation is achieved; the primary risk is a forced process termination or instability. The vulnerability is listed as not in the CISA KEV catalog.