CVE-2025-22013

What it actually does

Incorrect lazy saving of host FPSIMD/SVE/SME state in KVM arm64 hypervisor code causes unexpected discard of host SVE registers or stale FPMR values due to TIF_SVE/CPACR_ELx.ZEN mismatches, resulting in memory corruption or state loss when loading vCPUs.

Why it matters to the business

Virtual machine instability and crashes on arm64 systems running KVM, particularly affecting workloads using SVE instructions, leading to downtime and the need for immediate kernel patching across affected Red Hat environments.

How an attack unfolds

An attacker running or controlling VMs on an affected arm64 KVM host triggers the state-saving inconsistency by executing SVE-using code such as memmove inside the guest or via ptrace modifications, causing host state corruption or QEMU crashes; related kernel privilege escalation patterns seen in similar CVEs could be adapted but no public exploit for this issue exists.

How to fix it

Apply the provided kpatch updates for Red Hat rhel_eus 8.6 (e.g., kpatch-patch-4_18_0-372_26_1 to version 0:1-5.el8_6 and similar for other listed packages) or upgrade the Linux kernel to the fixed commit 5289ac43b69c61a49c75720921f2008005a31c43 in the stable git tree.

How to confirm the fix worked

Confirm presence of updated kpatch packages matching the fixed versions listed or verify the kernel contains commit 5289ac43b69c; re-test SVE workloads with QEMU/VMs to ensure no state discard occurs.

Typical attack path

1. Gain ability to run or interact with VMs on vulnerable arm64 KVM host
2. Execute SVE-enabled operations or ptrace calls from guest or host context
3. Force vCPU load path to expose lazy FPSIMD/SVE save flaws
4. Trigger host state discard or corruption leading to crash or undefined behavior

How to detect it

Review kernel logs and QEMU crash reports for symptoms matching SVE state discard or FPMR staleness on arm64 KVM hosts; no confirmed in-the-wild exploitation indicators exist given the low EPSS and non-KEV status.

What your security team should do

• Prioritize deployment of listed kpatch fixes on all affected Red Hat arm64 KVM hosts
• Monitor upstream stable kernel trees for backports to older releases
• Validate SVE-enabled applications and virtualization stability after patching