The flaw resides in the Linux kernel’s arm64 FP/SIMD signal handling logic. When a system advertises support for SME but not for SVE, the kernel erroneously accepts an SVE signal payload that contains non‑streaming state because it does not reject the case where the flag indicating SME presence is cleared yet an SVE payload is still present. This mis‑validation allows a crafted signal context to inject an unsupported SVE state into a task, and when the kernel later attempts to restore that state it triggers an undefined instruction exception (EL1 UNDEF), immediately causing a kernel panic. Affected systems are all Linux kernel builds that have not incorporated the patch that reworks `restore_sve_fpsimd_context()`. The code changes referenced in the advisory commit bundle (e.g., `c/2bce6f006cfe0b60e8249fd8d51396d99355cba3`) fix the issue. Systems using release candidate 7.3.0‑rc1 and earlier stable kernels remain vulnerable. The CVSS score is 5.5 and the EPSS score is < 1%, so the specific exploitation likelihood cannot be quantified given the low probability. Nonetheless, because the vulnerability leads to a kernel panic—a high‑impact outcome—it poses a significant risk. Exploitation requires constructing a signal frame that bypasses kernel checks, which makes it non‑trivial but not impossible, particularly in environments where processes can send custom signals or where untrusted code can create such contexts.

Affected systems include all Linux kernel builds for ARM64 that support SME but not SVE. The kernel vendor is Linux, product is Linux kernel. Specific version identifiers are not provided in the CVE data; the vulnerability applies to any kernel revision that has omitted the patch introduced in the referenced commits. Commonly impacted kernels include older release candidates such as 7.3.0‑rc1 and earlier stable versions.

The CVSS score is 5.5, and EPSS is < 1%, so an exact numerical risk assessment cannot be made. The issue is listed in neither KEV. The vulnerability can be exploited by delivering a meticulously crafted signal frame that contains an unsupported SVE payload on systems that report SME support only. When the kernel processes the signal, it will restore an illegal non‑streaming SVE state, causing an EL1 UNDEF and ultimately a kernel panic that brings the system down. Because the exploit requires only the ability to send a signal with a custom context, it could be triggered by unprivileged users on untrusted systems where such crafted signals can be injected.