{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2025-38435",
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "state": "PUBLISHED",
        "assignerShortName": "Linux",
        "dateReserved": "2025-04-16T04:51:24.016Z",
        "datePublished": "2025-07-25T14:32:09.136Z",
        "dateUpdated": "2026-08-05T12:01:52.506Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
                "shortName": "Linux",
                "dateUpdated": "2026-08-05T12:01:52.506Z"
            },
            "descriptions": [
                {
                    "lang": "en",
                    "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: vector: Fix context save/restore with xtheadvector\n\nPreviously only v0-v7 were correctly saved/restored,\nand the context of v8-v31 are damanged.\nCorrectly save/restore v8-v31 to avoid breaking userspace."
                }
            ],
            "metrics": [
                {
                    "cvssV3_1": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                        "baseScore": 7.8,
                        "baseSeverity": "HIGH"
                    },
                    "scenarios": [
                        {
                            "lang": "en",
                            "value": "AV:L - Exploitation requires executing instructions on the affected hart to read and plant vector register values across a context switch; there is no remote or network-reachable path to the vector save/restore code.\nAC:L - On T-Head xtheadvector hardware the omission of v8-v31 from restore is unconditional and deterministic, so the attacker simply spins reading v8-v31 after each scheduling event; no race, memory layout, or uncontrolled state is involved, and the enabling config is default-y.\nPR:L - Any unprivileged local task can use vector (CONFIG_RISCV_ISA_V_DEFAULT_ENABLE=y, and riscv_v_vstate_ctrl_set_current() unconditionally allows PR_RISCV_V_VSTATE_CTRL_ON), so only a basic user account is needed.\nUI:N - The leak and corruption occur automatically on every context switch and signal return; no victim action beyond normal execution is required.\nS:U - The vulnerable code and the impacted processes are all governed by the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed, and guest vector is never enabled on xtheadvector hosts.\nC:H - v8-v31 are never restored, so an attacker task inherits 24 registers of another process's live vector state and can sample this continuously across context switches, harvesting arbitrary secret data that transits vectorized memcpy/string/crypto routines in privileged processes.\nI:H - The attacker can leave arbitrary chosen values in v8-v31 that a victim process then computes with, and for indexed/gather vector loads and stores those attacker-controlled values become addresses inside the victim, giving attacker-directed corruption of another process's data.\nA:H - Every vector-using process on the machine is deterministically resumed with damaged v8-v31, and an attacker can deliberately poison those registers so victims fault on indexed vector accesses, reliably crashing arbitrary processes including system daemons."
                        }
                    ]
                }
            ],
            "affected": [
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "unaffected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "arch/riscv/include/asm/vector.h"
                    ],
                    "versions": [
                        {
                            "version": "d863910eabaffc68eb28aaf476dd870fc3f7197d",
                            "lessThan": "dd5ceea8d50e9e108a10d1e0d89fa2c9ff442ca2",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "d863910eabaffc68eb28aaf476dd870fc3f7197d",
                            "lessThan": "4262bd0d9cc704ea1365ac00afc1272400c2cbef",
                            "status": "affected",
                            "versionType": "git"
                        }
                    ]
                },
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "affected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "arch/riscv/include/asm/vector.h"
                    ],
                    "versions": [
                        {
                            "version": "6.14",
                            "status": "affected"
                        },
                        {
                            "version": "0",
                            "lessThan": "6.14",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.15.5",
                            "lessThanOrEqual": "6.15.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.16",
                            "lessThanOrEqual": "*",
                            "status": "unaffected",
                            "versionType": "original_commit_for_fix"
                        }
                    ]
                }
            ],
            "cpeApplicability": [
                {
                    "nodes": [
                        {
                            "operator": "OR",
                            "negate": false,
                            "cpeMatch": [
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.14",
                                    "versionEndExcluding": "6.15.5"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.14",
                                    "versionEndExcluding": "6.16"
                                }
                            ]
                        }
                    ]
                }
            ],
            "references": [
                {
                    "url": "https://git.kernel.org/stable/c/dd5ceea8d50e9e108a10d1e0d89fa2c9ff442ca2"
                },
                {
                    "url": "https://git.kernel.org/stable/c/4262bd0d9cc704ea1365ac00afc1272400c2cbef"
                }
            ],
            "title": "riscv: vector: Fix context save/restore with xtheadvector",
            "x_generator": {
                "engine": "bippy-1.2.0"
            }
        }
    }
}