CVE-2025-68171 x86/fpu: Ensure XFD state on signal delivery
A kernel bug causes a warning and potential instability during signal delivery when AMX tasks preempt non-AMX tasks, requiring a patch to synchronize XFD state.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-68171?
CVE-2025-68171 is a high-severity denial of service vulnerability in Linux, published on 16 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
x86/fpu: Ensure XFD state on signal delivery
Sean reported [1] the following splat when running KVM tests:
WARNING: CPU: 232 PID: 15391 at xfd_validate_state+0x65/0x70 Call Trace: <TASK> fpu__clear_user_states+0x9c/0x100 arch_do_signal_or_restart+0x142/0x210 exit_to_user_mode_loop+0x55/0x100 do_syscall_64+0x205/0x2c0 entry_SYSCALL_64_after_hwframe+0x4b/0x53
Chao further identified [2] a reproducible scenario involving signal delivery: a non-AMX task is preempted by an AMX-enabled task which modifies the XFD MSR.
When the non-AMX task resumes and reloads XSTATE with init values, a warning is triggered due to a mismatch between fpstate::xfd and the CPU's current XFD state. fpu__clear_user_states() does not currently re-synchronize the XFD state after such preemption.
Invoke xfd_update_state() which detects and corrects the mismatch if there is a dynamic feature.
This also benefits the sigreturn path, as fpu__restore_sig() may call fpu__clear_user_states() when the sigframe is inaccessible.
[ dhansen: minor changelog munging ]
Which versions are affected by CVE-2025-68171?
How do I fix CVE-2025-68171?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-68171 being exploited?
There is no known exploitation of CVE-2025-68171 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2025-68171, DEBIAN-CVE-2025-68171, GHSA-4ggp-pgr3-73m2, ROOT-OS-DEBIAN-12-CVE-2025-68171, ROOT-OS-DEBIAN-13-CVE-2025-68171, ROOT-OS-UBUNTU-2204-CVE-2025-68171 and 2 more.