[PATCH 0/4] arm64: Work around C1-Pro erratum 4193714 (CVE-2026-0995)

Catalin Marinas
2026-03-02T16:58:07Z

Arm C1-Pro prior to r1p3 has an erratum (4193714) where a TLBI+DSB
sequence might fail to ensure the completion of all outstanding SME
(Scalable Matrix Extension) memory accesses. The DVMSync message is
acknowledged before the SME accesses have fully completed, potentially
allowing pages to be reused before all in-flight accesses are done.

The workaround consists of executing a DSB locally (via IPI)
on all affected CPUs running with SME enabled, after the TLB
invalidation. This ensures the SME accesses have completed before the
IPI is acknowledged.

The first two patches are preparatory: patch 1 adds
__tlbi_sync_s1ish_kernel() to distinguish kernel from user TLB
maintenance; patch 2 passes the mm_struct to __tlbi_sync_s1ish().

Patch 3 implements the actual erratum workaround for the kernel
(non-virtualised) case. It applies only to user mappings and limited to
tasks using SME (tracked via a new MMCF_SME_DVMSYNC flag) and running at
EL0. The smp_call_function() does not need an explicit DSB on the
interrupted CPUs since SCTLR_EL1.IESB=1 forces the completion of SME
accesses when entering the kernel from EL0.

Patch 4 handles the pKVM case. The aim is to ensure the kernel will not
compromise the security of protected guests. pKVM delegates the
workaround to EL3 via an SMC call (to Trusted Firmware-A). The TF-A
patches are provided separately in the project's repository.

Since SME in guests is not currently supported, no additional KVM
workaround needed to prevent guests from exploiting the erratum.

This has been assigned CVE-2026-0995:

https://developer.arm.com/documentation/111823/latest/

Backports available here (no stable-6.12.y since SME is not supported):

https://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git errata/c1-pro-erratum-4193714-stable-6.19.y
https://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git errata/c1-pro-erratum-4193714-stable-6.18.y
https://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git errata/c1-pro-erratum-4193714-android16-6.12-lts

Thanks.

Catalin Marinas (3):
arm64: tlb: Use __tlbi_sync_s1ish_kernel() for kernel TLB maintenance
arm64: tlb: Pass the corresponding mm to __tlbi_sync_s1ish()
arm64: errata: Work around early CME DVMSync acknowledgement

James Morse (1):
KVM: arm64: Add SMC hook for SME dvmsync erratum

arch/arm64/Kconfig | 12 ++++
arch/arm64/include/asm/cpucaps.h | 2 +
arch/arm64/include/asm/cputype.h | 2 +
arch/arm64/include/asm/fpsimd.h | 29 ++++++++++
arch/arm64/include/asm/mmu.h | 1 +
arch/arm64/include/asm/tlbflush.h | 39 ++++++++++---
arch/arm64/kernel/cpu_errata.c | 19 +++++++
arch/arm64/kernel/entry-common.c | 3 +
arch/arm64/kernel/fpsimd.c | 81 +++++++++++++++++++++++++++
arch/arm64/kernel/process.c | 7 +++
arch/arm64/kernel/sys_compat.c | 2 +-
arch/arm64/kvm/hyp/nvhe/mem_protect.c | 17 ++++++
arch/arm64/tools/cpucaps | 1 +
include/linux/arm-smccc.h | 5 ++
14 files changed, 211 insertions(+), 9 deletions(-)