CVE-2024-50275: Linux Kernel Race Condition Vulnerability

CVE-2024-50275 Overview

CVE-2024-50275 is a race condition in the Linux kernel's arm64/sve Scalable Vector Extension (SVE) trap handling logic. The flaw resides in the do_sve_acc() path, where preemption between manipulating saved FPSIMD/SVE state can leave a task with TIF_SVE set and TIF_FOREIGN_FPSTATE cleared while the live CPU state remains stale. When the task returns to userspace, the kernel skips the hardware state restore and reuses stale CPU register state, producing kernel warnings and undefined behavior on arm64 systems.

Critical Impact
Local attackers or workloads on arm64 hardware can trigger inconsistent FPSIMD/SVE state via preemption races, leading to corruption of vector register state, kernel warnings, and potential confidentiality or integrity impact on shared CPUs.

Affected Products

Linux Kernel 6.12-rc1 through 6.12-rc6
Linux Kernel stable branches prior to backported fixes 51d11ea0250d, 751ecf6afd65, and fa9ce027b3ce
Debian LTS distributions tracked in the March 2025 LTS advisory

Discovery Timeline

2024-11-19 - CVE-2024-50275 published to NVD
2025-11-03 - Last updated in NVD database

Technical Details for CVE-2024-50275

Vulnerability Analysis

The vulnerability is a race condition [CWE-362] in the arm64 SVE trap handler do_sve_acc(). The handler manages the per-task FPSIMD and SVE register state and relies on two thread flags: TIF_SVE, which indicates SVE is in use for the task, and TIF_FOREIGN_FPSTATE, which indicates the live CPU state does not match the task's saved state.

When a task first executes an SVE instruction without TIF_SVE set, the CPU raises an SVE access trap. The handler is expected to allocate SVE storage, convert FPSIMD state to SVE format, and set TIF_SVE. The flaw occurs when preemption interleaves with these steps, allowing the task to migrate between CPUs and return to the original CPU with stale per-CPU state still recorded in fpsimd_last_state.

Root Cause

The root cause is incorrect handling of the case where TIF_FOREIGN_FPSTATE is set inside sve_init_regs() after preemption. The handler clears TIF_FOREIGN_FPSTATE without invalidating the per-CPU fpsimd_last_state pointer. If the task is subsequently rescheduled onto the same CPU whose fpsimd_last_state still references it, the kernel assumes the live hardware state is current and skips reloading registers from memory. The stale hardware state, with SVE traps still enabled, is then exposed to userspace.

Attack Vector

Exploitation requires local code execution on an arm64 system with SVE support. An unprivileged process can repeatedly trigger SVE access traps under scheduler pressure to provoke the migration pattern. The trap handler must be preempted, migrated to another CPU, and then migrated back before the per-CPU fpsimd_last_state is invalidated. The result is either a kernel warning from the WARN_ON(1) in do_sve_acc() or silent reuse of stale vector register state across context switches, which can leak or corrupt register contents between tasks sharing the CPU.

No verified public exploit is available. The vulnerability mechanism is described in the upstream commits referenced in the Kernel Git Commit Fix and the Debian LTS Announcement.

Detection Methods for CVE-2024-50275

Indicators of Compromise

Kernel log entries containing WARN_ON traces originating from do_sve_acc() on arm64 hosts
Repeated SIGILL or unexpected SVE-related faults in userspace workloads on arm64
Unexplained FPSIMD/SVE register corruption reported by HPC, ML, or cryptographic workloads

Detection Strategies

Monitor dmesg and journald for warnings emitted from arch/arm64/kernel/fpsimd.c and the do_sve_acc symbol
Compare running kernel versions against the patched commits 51d11ea0250d, 751ecf6afd65, and fa9ce027b3ce using package inventory tooling
Track scheduler and migration metrics on arm64 hosts running SVE-enabled workloads to identify abnormal trap rates

Monitoring Recommendations

Forward kernel ring buffer events to a centralized logging pipeline and alert on do_sve_acc or fpsimd_flush_task_state stack frames
Inventory arm64 endpoints and servers and confirm kernel build identifiers match vendor-patched versions
Audit workloads that rely on SVE instructions, including AI inference and cryptographic libraries, for unexplained crashes or numerical anomalies

How to Mitigate CVE-2024-50275

Immediate Actions Required

Apply the upstream Linux kernel patches that invoke fpsimd_flush_task_state() when TIF_FOREIGN_FPSTATE is set inside the SVE trap handler
Update Debian and other downstream distributions to the kernel versions referenced in the March 2025 Debian LTS announcement
Reboot arm64 hosts after applying the patched kernel to ensure the corrected trap handler is active

Patch Information

The fix calls fpsimd_flush_task_state() to detach the task from any stale per-CPU saved state, ensuring a subsequent context switch sets TIF_FOREIGN_FPSTATE and reloads register state from memory. Stable backports are available at the Kernel Git Commit Update, the Kernel Git Commit Patch, and the Kernel Git Commit Security.

Workarounds

Disable SVE on affected arm64 systems by booting with the arm64.nosve kernel command-line parameter where workloads do not require SVE
Restrict execution of untrusted workloads on arm64 hosts until the patched kernel is deployed
Pin sensitive workloads to dedicated CPUs to reduce the migration window required to trigger the race

bash

# Verify the running kernel includes the SVE trap fix on Debian-based systems
uname -r
apt-get changelog linux-image-$(uname -r) | grep -i 'CVE-2024-50275'

# Optional: disable SVE at boot if patching is delayed (arm64 only)
# Append to GRUB_CMDLINE_LINUX in /etc/default/grub:
# arm64.nosve
sudo update-grub