A flaw in the ARM64 trace context handling causes the restore of a ZA (SVE/SSVE) signal context to set the thread flag TIF_SME without first ensuring that the task’s sve_state structure is allocated. When a ZA context is restored that was not created by the kernel—such as during a task checkpoint/restore with CRIU—the kernel may enter a state in which TIF_SME is set but sve_state is NULL. If the user process then attempts to use streaming mode, the kernel will later dereference the null sve_state pointer and crash, producing an oops and a kernel panic. This results in an availability impact; no direct privilege escalation is described. The vulnerability is limited to the Linux kernel’s arm64/fpsimd subsystem and manifests during signal handling paths when a ZA context is restored. The flaw is fixed by ensuring that restore_za_context allocates the sve_state before setting TIF_SME, preserving any pre‑existing SVE/SSVE state.

All Linux kernel releases that include the arm64/fpsimd signal handling code and that have not yet incorporated the patch are affected. The CVE references apply to kernel versions 6.19‑rc1 through 6.19‑rc6; any later stable release containing the fix (or a backport) is no longer vulnerable.

The CVSS score is 5.5, indicating moderate severity. The EPSS score is less than 1 %, reflecting a low probability of exploitation in the wild. The vulnerability is not currently listed in the CISA KEV catalog. The attack vector is inferred to be local, where an attacker can construct or manipulate a ZA signal context—such as by using checkpoint/restore tools or crafting a malicious user-mode program—to trigger the dereference and cause a kernel panic. Proper mitigation requires updating the kernel or avoiding the problematic restore path until the patch is applied.