{"id":"CVE-2025-22013","title":"kernel: KVM: arm64: Unconditionally save+flush host FPSIMD/SVE/SME state (CVE-2025-22013)","summary":"A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem on ARM64 architectures. The hypervisor improperly manages host floating-point and vector register states when switching context to a virtual machine. A loc…","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":"CWE-99","vendor":"Red Hat","product":"Red Hat Enterprise Linux BaseOS EUS (v.9.4)","affected":["enterprise_linux 10","enterprise_linux 9","enterprise_linux_appstream_eus_v_9_4","enterprise_linux_baseos_eus_v_9_4","codeready_linux_builder_eus_v_9_4","enterprise_linux_real_time_for_nfv_eus_v_9_4","enterprise_linux_real_time_eus_v_9_4"],"patched":["enterprise_linux_appstream_eus_v_9_4","enterprise_linux_baseos_eus_v_9_4","codeready_linux_builder_eus_v_9_4","enterprise_linux_real_time_for_nfv_eus_v_9_4","enterprise_linux_real_time_eus_v_9_4"],"published":"2025-04-08","updated":"2026-10-16","sourceUpdated":"2026-10-16T18:34:06+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-22013.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-22013.json"},{"url":"https://access.redhat.com/security/cve/CVE-2025-22013"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2358222"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-22013"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-22013"},{"url":"https://lore.kernel.org/linux-cve-announce/2025040843-CVE-2025-22013-c885@gregkh/T"},{"url":"https://access.redhat.com/errata/RHSA-2025:3510"},{"url":"https://git.kernel.org/stable/c/5289ac43b69c61a49c75720921f2008005a31c43"},{"url":"https://git.kernel.org/stable/c/04c50cc23a492c4d43fdaefc7c1ecc0ff6f7b82e"},{"url":"https://git.kernel.org/stable/c/806d5c1e1d2e5502175a24bf70f251648d99c36a"},{"url":"https://git.kernel.org/stable/c/79e140bba70bcacc5fe15bf8c0b958793fd7d56f"},{"url":"https://git.kernel.org/stable/c/900b444be493b7f404898c785d6605b177a093d0"},{"url":"https://git.kernel.org/stable/c/fbc7e61195e23f744814e78524b73b59faa54ab4"}],"tags":["csaf","vex","red-hat","cve.org"],"epss":0.00212,"epssPercentile":0.10729,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-15T21:44:00.434508Z"},"scores":{"vendor":5.5,"cna":7.3},"ingestedAt":"2026-10-15T22:48:25.471Z","slug":"CVE-2025-22013","body":"## Overview\n\nA flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem on ARM64 architectures. The hypervisor improperly manages host floating-point and vector register states when switching context to a virtual machine. A local user with privileges to run virtual machines can exploit this flaw to cause host virtualization processes to crash, resulting in a Denial of Service (DoS), or potentially cause register state corruption.\n\n## Vendor advisories\n\n- **RHSA-2025:3510** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.4), Red Hat Enterprise Linux BaseOS EUS (v.9.4), Red Hat CodeReady Linux Builder EUS (v.9.4), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.4), Red Hat Enterprise Linux Real Time EUS (v.9.4) · released 2025-04-02 · [advisory](https://access.redhat.com/errata/RHSA-2025:3510)\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-22013.json)\n\n**kernel: KVM: arm64: Unconditionally save+flush host FPSIMD/SVE/SME state** — rated Moderate by Red Hat. Released 2025-04-08, updated 2026-10-16.\n\nAffected:\n\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 9\n\nFixed:\n\n- Red Hat Enterprise Linux AppStream EUS (v.9.4)\n- Red Hat Enterprise Linux BaseOS EUS (v.9.4)\n- Red Hat CodeReady Linux Builder EUS (v.9.4)\n- Red Hat Enterprise Linux Real Time for NFV EUS (v.9.4)\n- Red Hat Enterprise Linux Real Time EUS (v.9.4)\n\nNo fix planned:\n\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 9\n\nNot affected:\n\n- Red Hat Enterprise Linux 6\n- Red Hat Enterprise Linux 7\n- Red Hat Enterprise Linux 8\n\n## Remediation\n\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nThe system must be rebooted for this update to take effect. https://access.redhat.com/errata/RHSA-2025:3510\n\nWorkarounds / mitigations:\n\n- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":223783,"id":"CVE-2025-22013","ts":1792238423329,"field":"cvss","old":"7.3","new":"5.5"},{"seq":223782,"id":"CVE-2025-22013","ts":1792238423329,"field":"severity","old":"high","new":"medium"}]}