CVE-2026-0995: Arm C1-Pro Use-After-Free Vulnerability

CVE-2026-0995 Overview

A race condition vulnerability has been identified in Arm C1-Pro processors before version r1p2-50eac0. Under certain conditions, a TLBI (Translation Lookaside Buffer Invalidate) combined with DSB (Data Synchronization Barrier) instruction sequence might fail to ensure the completion of memory accesses related to the Scalable Matrix Extension (SME). This hardware-level timing issue could allow incomplete memory synchronization, potentially leading to data integrity issues or unexpected system behavior.

Critical Impact

This race condition in the TLB invalidation and barrier synchronization mechanism could result in incomplete memory access operations for SME workloads, potentially causing data corruption or system instability in affected Arm C1-Pro processors.

Affected Products

• Arm C1-Pro processors before r1p2-50eac0

Discovery Timeline

• 2026-03-02 - CVE CVE-2026-0995 published to NVD
• 2026-03-02 - Last updated in NVD database

Technical Details for CVE-2026-0995

Vulnerability Analysis

This vulnerability is classified as CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization), commonly known as a race condition. The issue exists at the hardware level within Arm C1-Pro processors and affects the synchronization mechanism between TLB invalidation operations and memory accesses performed by the Scalable Matrix Extension (SME).

In ARM architecture, TLBI instructions are used to invalidate TLB entries, and DSB (Data Synchronization Barrier) instructions are supposed to ensure that all preceding memory operations complete before execution continues. However, in affected C1-Pro processors, this synchronization guarantee may not hold under certain timing conditions when SME operations are involved.

The local attack vector and high attack complexity indicate that exploitation requires direct access to the affected system and specific conditions must align for the vulnerability to manifest. The low privileges required suggest that any authenticated user could potentially trigger the condition.

Root Cause

The root cause lies in the microarchitectural implementation of the C1-Pro processor's memory management unit (MMU) and its interaction with the Scalable Matrix Extension. Specifically, the hardware fails to properly serialize SME-related memory accesses when a TLBI+DSB sequence is executed. This creates a window where SME memory operations that should be completed before the barrier may remain in-flight, violating the expected memory ordering guarantees.

Attack Vector

The attack requires local access to a system running an affected Arm C1-Pro processor. An attacker with low-level privileges could potentially exploit this timing window to:

1. Cause data integrity issues by triggering incomplete memory synchronization during TLB maintenance operations
2. Create denial of service conditions by inducing unexpected system behavior
3. Potentially access stale TLB entries that should have been invalidated

The vulnerability requires precise timing and specific workload patterns involving SME operations, making exploitation complex but feasible under controlled conditions.

The vulnerability manifests during the TLBI+DSB instruction sequence when SME operations are concurrently accessing memory. For detailed technical analysis of the affected instructions and microarchitectural behavior, refer to the ARM Developer Documentation.

Detection Methods for CVE-2026-0995

Indicators of Compromise

• Unexpected data corruption in applications utilizing SME (Scalable Matrix Extension) workloads
• System instability or crashes during TLB maintenance operations on affected processors
• Memory consistency errors in matrix computation results

Detection Strategies

• Monitor system logs for unexpected memory-related errors or kernel panics on systems with Arm C1-Pro processors
• Implement integrity checks for SME-intensive workloads to detect potential data corruption
• Use hardware performance counters to monitor TLB invalidation patterns and SME memory access anomalies

Monitoring Recommendations

• Deploy system monitoring to track kernel memory management events on affected processor architectures
• Implement application-level data validation for SME workloads to detect potential synchronization failures
• Monitor for unusual patterns in memory access timing that could indicate exploitation attempts

How to Mitigate CVE-2026-0995

Immediate Actions Required

• Identify all systems running Arm C1-Pro processors with firmware versions prior to r1p2-50eac0
• Plan firmware updates to the patched version during scheduled maintenance windows
• Consider reducing SME workload intensity on affected systems until patching is complete

Patch Information

Arm has addressed this vulnerability in C1-Pro firmware version r1p2-50eac0 and later. System administrators should consult the ARM Developer Documentation for detailed update procedures and firmware availability for their specific hardware platforms.

Workarounds

• Limit access to affected systems to trusted users only, given the local attack vector requirement
• Consider disabling or limiting SME functionality on critical systems until firmware updates can be applied
• Implement additional software-level memory barriers in SME-intensive applications as a defense-in-depth measure

For firmware update procedures and detailed mitigation guidance, consult the vendor documentation at the ARM Developer Documentation.