CVE-2025-0647: Arm C1-ultra Firmware Privilege Escalation

CVE-2025-0647 Overview

CVE-2025-0647 affects multiple Arm CPU designs where a CPP RCTX (Clear Prediction Context) instruction executed on one Processing Element (PE) may inhibit Translation Lookaside Buffer (TLB) invalidation. When a TLBI (TLB Invalidate) instruction is issued to the PE, either by the same PE or another PE in the shareability domain, the PE may retain stale TLB entries that should have been invalidated. The flaw is classified under CWE-226 (Sensitive Information in Resource Not Removed Before Reuse). Exploitation requires local access with high privileges, but the scope is changed, impacting confidentiality and integrity across security boundaries enforced by memory translation.

Critical Impact
Stale TLB entries retained after invalidation can allow a privileged local actor to access memory mappings that should no longer be valid, undermining isolation guarantees between security contexts.

Affected Products

Arm C1-Ultra and C1-Premium (with firmware)
Arm Cortex-A710, Cortex-X2, Cortex-X3, Cortex-X4, Cortex-X925
Arm Neoverse-N2, Neoverse-V2, Neoverse-V3, Neoverse-V3AE

Discovery Timeline

2026-01-14 - CVE-2025-0647 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-0647

Vulnerability Analysis

The vulnerability resides in the interaction between two Armv8/Armv9 architectural instructions. The CPP RCTX instruction clears branch and prediction context on a Processing Element. The TLBI family of instructions invalidates cached virtual-to-physical address translations across a shareability domain. On affected Arm cores, execution of CPP RCTX can suppress the effect of a concurrent or subsequent TLBI targeting the same PE.

When invalidation is inhibited, the PE continues to service address translations from stale TLB entries. Operating system kernels and hypervisors rely on TLBI completing correctly to enforce process isolation, guest-host separation, and page-permission changes. Retention of stale entries breaks this contract without producing an architectural fault.

Root Cause

The root cause is an implementation defect in the interaction between prediction-context clearing and TLB maintenance logic. Under specific timing conditions, the PE fails to observe or complete the TLBI broadcast within the inner shareability domain. This is a hardware behavior in the affected microarchitectures rather than a software flaw, and it aligns with [CWE-226] because privileged resources (TLB entries) are not cleared before reuse.

Attack Vector

Exploitation requires local execution at a privilege level able to issue system instructions such as CPP RCTX and TLBI. This typically means kernel, hypervisor, or a compromised guest OS with control of exception-level 1 or above. An attacker with such access can construct sequences that leave stale translations in place after the operating system believes memory has been remapped, unmapped, or had permissions tightened. The result is disclosure of memory contents or writes to memory the attacker should no longer reach, corresponding to the high confidentiality and integrity impact reflected in the scoring. See the Arm Security Advisory for microarchitectural detail.

Detection Methods for CVE-2025-0647

Indicators of Compromise

No public indicators of compromise or in-the-wild exploitation have been reported for CVE-2025-0647 as of the last NVD update.
Anomalous kernel or hypervisor behavior following legitimate page-table changes, such as unexpected access to recently unmapped pages, may indicate stale TLB retention.

Detection Strategies

Inventory the CPU models deployed across servers, workstations, and mobile devices and correlate against the affected Cortex, Neoverse, and C1 product list.
Track firmware and microcode revisions on affected platforms to identify systems that have not received the Arm-published mitigations.
Monitor kernel logs for unusual memory management faults, page-table integrity warnings, or hypervisor isolation alerts that could indicate stale TLB reuse.

Monitoring Recommendations

Ingest hardware and firmware inventory telemetry into a centralized data lake for continuous exposure assessment against Arm advisories.
Alert on privilege-escalation and kernel-integrity events on Arm-based hosts, as exploitation requires prior high-privilege access.
Correlate hypervisor and guest OS logs on Arm server platforms (Neoverse-N2, V2, V3, V3AE) to detect anomalous cross-guest memory behavior.

How to Mitigate CVE-2025-0647

Immediate Actions Required

Identify all systems running affected Arm CPUs by cross-referencing the CPE list against asset inventory.
Apply firmware and microcode updates provided by silicon integrators, OEMs, and platform vendors as they become available.
Update operating system and hypervisor kernels to versions that incorporate Arm's recommended software workarounds for TLB maintenance sequencing.
Restrict local privileged access on affected hosts, since exploitation requires high privilege on the target PE.

Patch Information

Arm has published guidance for this issue in the Arm Developer Documentation for CVE-2025-0647. Mitigation is delivered through a combination of CPU errata workarounds implemented in operating system and hypervisor code, and firmware updates supplied by platform vendors. Consult downstream OEM and Linux distribution advisories for the specific package or firmware version containing the fix for each affected core.

Workarounds

Avoid or serialize CPP RCTX execution around TLBI operations at the kernel or hypervisor level, following Arm's published errata workaround pattern.
Enforce strict privilege separation and disable untrusted kernel modules or unsigned hypervisor extensions on affected hardware.
Where firmware updates are unavailable, reduce exposure by limiting multi-tenant workloads on affected Neoverse server platforms until mitigations are deployed.