CVE-2025-68171

What it actually does

Race condition in x86 FPU handling allows XFD MSR state to become inconsistent with fpstate::xfd during signal delivery after preemption by an AMX task, triggering a kernel warning in xfd_validate_state and preventing proper resynchronization of extended feature state.

Why it matters to the business

Kernel warnings and potential FPU state corruption during signal handling can cause application instability or crashes on systems running mixed workloads involving advanced vector extensions, increasing operational risk for compute-heavy environments until patched.

How an attack unfolds

An attacker triggers preemption between a non-AMX task and an AMX-enabled task that alters the XFD MSR; on signal delivery the non-AMX task reloads stale XSTATE, causing the mismatch that the vulnerable fpu__clear_user_states path fails to correct.

How to fix it

Upgrade affected Ubuntu packages to the listed fixed versions: linux 3.11.0-12.19 or 4.4.0-2.16 or 5.15.0-23.23, linux-aws 4.4.0-1002.2 or 4.4.0-1001.10 or 5.15.0-1003.5, linux-lts-xenial 4.4.0-13.29~14.04.1, linux-kvm 4.4.0-1004.9, and the corresponding 5.15.0-* updates for azure, gcp, hwe, ibm, intel-iotg, lowlatency, oracle, riscv and gkeop variants.

How to confirm the fix worked

Confirm the running kernel version matches a fixed package, then exercise signal delivery under AMX preemption workloads and verify absence of the xfd_validate_state warning.

Typical attack path

1. Run or coerce a non-AMX process on a system also executing AMX workloads
2. Force preemption and signal delivery during FPU state transitions
3. Trigger fpu__clear_user_states without XFD resync, producing the warning and inconsistent state

How to detect it

Search kernel logs for the string 'WARNING: CPU:' accompanied by 'xfd_validate_state' or stack traces containing fpu__clear_user_states and arch_do_signal_or_restart; correlate with workloads involving AMX or dynamic XSTATE features.

What your security team should do

• Apply the exact fixed kernel packages for each affected Ubuntu release immediately
• Prioritize patching systems that run mixed vector workloads or host KVM guests
• Monitor kernel logs for xfd_validate_state warnings until all instances are updated