CVE-2026-23114

In the Linux kernel, the following vulnerability has been resolved: arm64/fpsimd: ptrace: Fix SVE writes on !SME systems When SVE is supported but SME is not supported, a ptrace write to the NT_ARM_SVE regset can place the tracee into an invalid state where (non-streaming) SVE register data is stored in FP_STATE_SVE format but TIF_SVE is clear. This can result in a later warning from fpsimd_restore_current_state(), e.g. WARNING: CPU: 0 PID: 7214 at arch/arm64/kernel/fpsimd.c:383 fpsimd_restore_current_state+0x50c/0x748 When this happens, fpsimd_restore_current_state() will set TIF_SVE, placing the task into the correct state. This occurs before any other check of TIF_SVE can possibly occur, as other checks of TIF_SVE only happen while the FPSIMD/SVE/SME state is live. Thus, aside from the warning, there is no functional issue. This bug was introduced during rework to error handling in commit: 9f8bf718f2923 ("arm64/fpsimd: ptrace: Gracefully handle errors") ... where the setting of TIF_SVE was moved into a block which is only executed when system_supports_sme() is true. Fix this by removing the system_supports_sme() check. This ensures that TIF_SVE is set for (SVE-formatted) writes to NT_ARM_SVE, at the cost of unconditionally manipulating the tracee's saved svcr value. The manipulation of svcr is benign and inexpensive, and we already do similar elsewhere (e.g. during signal handling), so I don't think it's worth guarding this with system_supports_sme() checks. Aside from the above, there is no functional change. The 'type' argument to sve_set_common() is only set to ARM64_VEC_SME (in ssve_set())) when system_supports_sme(), so the ARM64_VEC_SME case in the switch statement is still unreachable when !system_supports_sme(). When CONFIG_ARM64_SME=n, the only caller of sve_set_common() is sve_set(), and the compiler can constant-fold for the case where type is ARM64_VEC_SVE, removing the logic for other cases.

• https://git.kernel.org/stable/c/128a7494a9f15aad60cc6b7e3546bf481ac54a13Patch
• https://git.kernel.org/stable/c/4f39984176e7edcaba3432b6c649c6fe93bf2f80Patch

Published

Feb 14, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-23109In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-2311IBM i 7.6, 7.5, 7.4, 7.3, and 7.2 s vulnerable to privilege …9.8
• CVE-2026-23110In the Linux kernel, the following vulnerability has been re…4.7
• CVE-2026-23111In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-23112In the Linux kernel, the following vulnerability has been re…9.8
• CVE-2026-23113In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-23115In the Linux kernel, the following vulnerability has been re…4.7
• CVE-2026-23116In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-23117In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-23118In the Linux kernel, the following vulnerability has been re…4.7
• CVE-2026-23119In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-2312The Media Library Folders plugin for WordPress is vulnerable…4.3