CVE-2023-53713

A flaw in the Linux kernel's ARM64 Scalable Matrix Extension (SME) support results in memory corruption when the system operates in streaming SVE mode [1]. The FFR (First Fault Register) is a predicate register whose size varies (16–256 bits) based on the configured vector length [1]. Commit 9f5848665788 made access to FFR optional by clearing its in-memory context field, but it did so using an unconditional 8-byte store (STR) [1]. If the SME vector length is not exactly 64 bytes, this store either fails to zero the entire field or corrupts memory adjacent to the structure [1].

The issue is exploitable without special privileges; any code path that triggers saving SVE state in streaming SVE mode can encounter the bug [1]. If the vector length is larger than 64 bytes, only the first 8 bytes are cleared, leaving stale data in the rest of the FFR field. If the vector length is smaller, the 8-byte write overwrites memory beyond the field, causing buffer overflow [1]. This has been observed in practice as intermittent kfence splats and kmalloc Redzone corruption during the fp-stress kselftest [1].

Impact includes kernel memory corruption, which can lead to system instability, data corruption, or potentially exploitable memory safety violations (e.g., heap overflow) [1]. The corruption manifests as kmalloc Redzone overwrites, indicating that adjacent kernel heap objects are being corrupted [1].

The fix replaces the 8-byte store with a store of a zero-initialised predicate register (using PFALSE) [1]. This ensures the entire FFR field is correctly cleared regardless of vector length [1]. The patch has been applied to the stable kernel tree and is available in the referenced commit [1].