CVE-2026-23114: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23114 is a kernel state management vulnerability in the Linux kernel affecting ARM64 systems that support SVE (Scalable Vector Extension) but not SME (Streaming SVE). A ptrace write to the NT_ARM_SVE regset can place a traced process into an invalid state where SVE register data is stored in FP_STATE_SVE format while the TIF_SVE flag remains clear. The bug was introduced during error-handling refactoring in commit 9f8bf718f2923 ("arm64/fpsimd: ptrace: Gracefully handle errors"), where the setting of TIF_SVE was incorrectly moved into a block conditional on system_supports_sme(). Affected versions include Linux kernel 6.16 through 6.18.7 and 6.19-rc1 through 6.19-rc6. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is improper state management (CWE-664) in the ARM64 floating-point/SVE ptrace handling code within arch/arm64/kernel/fpsimd.c. When a privileged tracer writes SVE register data via NT_ARM_SVE on a system without SME, the kernel fails to set the TIF_SVE thread flag because the relevant code path is gated behind a system_supports_sme() check. This leaves the task in an inconsistent state: SVE-formatted data is present but the flag indicating active SVE state is absent. The fix removes the system_supports_sme() guard so that TIF_SVE is unconditionally set for SVE-formatted writes to NT_ARM_SVE, with the incidental manipulation of the svcr value being benign. Exploitation requires local access with ptrace privileges (e.g., a debugger or a process with CAP_SYS_PTRACE or a permissive ptrace policy) (Feedly, Kernel Patch 1, Kernel Patch 2).

Successful exploitation causes fpsimd_restore_current_state() to emit a kernel WARNING and intervene to correct the invalid thread state. While the kernel self-corrects before any functional issue can propagate, repeated triggering of this condition constitutes a denial-of-service vector through kernel warning spam and forced state correction overhead. There is no confidentiality or integrity impact; the availability impact is rated High due to the potential for repeated disruption of floating-point/SVE state restoration on affected ARM64 systems (Feedly).

• Logs: Kernel warning messages in dmesg or /var/log/kern.log referencing fpsimd_restore_current_state+0x50c/0x748 or similar offsets in arch/arm64/kernel/fpsimd.c:383.
• Process Behavior: Unusual ptrace activity targeting ARM64 processes on systems with SVE but without SME support; repeated attachment and detachment of a debugger to a target process with SVE register writes via NT_ARM_SVE.

Update the Linux kernel to version 6.18.8 or later (for systems on the 6.16–6.18 branch) or to the 6.19 stable release (for systems tracking 6.19 release candidates). The upstream fix is available in two patch commits on git.kernel.org: 128a7494a9f15aad60cc6b7e3546bf481ac54a13 and 4f39984176e7edcaba3432b6c649c6fe93bf2f80. As a workaround prior to patching, restrict ptrace access by enforcing kernel.yama.ptrace_scope = 1 or higher via sysctl, limiting ptrace to parent processes only. Monitor systems for kernel warnings related to fpsimd_restore_current_state() as a detection signal on unpatched hosts (Feedly, Kernel Patch 1, Kernel Patch 2).