Description
Use of Hardware Page Aggregation (HPA) and Stage-1 and/or Stage-2 translation on Cortex-A77, Cortex-A78, Cortex-A78C, Cortex-A78AE, Cortex-A710, Cortex-X1, Cortex-X1C, Cortex-X2, Cortex-X3, Cortex-X4, Cortex-X925, Neoverse V1, Neoverse V2, Neoverse V3, Neoverse V3AE, Neoverse N2 may permit bypass of Stage-2 translation and/or GPT protection.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Arm | Cortex-A77 | — | — |
| Arm | Neoverse V1 | — | — |
| Arm | Cortex-A78AE | — | — |
| Arm | Cortex-78C | — | — |
| Arm | Cortex-X1C | — | — |
| Arm | Cortex-A78 | — | — |
| Arm | Cortex-X1 | — | — |
| Arm | Neoverse N2 | — | — |
| Arm | Cortex-A710 | — | — |
| Arm | Cortex-X2 | — | — |
| Arm | Neoverse V2 | — | — |
| Arm | Cortex-X3 | — | — |
| Arm | Neoverse V3AE | — | — |
| Arm | Neoverse V3 | — | — |
| Arm | Cortex-X4 | — | — |
| Arm | Cortex-X925 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | arm-trusted-firmware | 2.12.1+dfsg-1 | — |
| Debian 13 | arm-trusted-firmware | 2.12.1+dfsg-1 | — |
| Debian 12 | arm-trusted-firmware | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | arm-trusted-firmware | No fix yet | — |
| Ubuntu 26.04 LTS | arm-trusted-firmware | No fix yet | — |
| Ubuntu 25.10 | arm-trusted-firmware | No fix yet | — |
| Ubuntu 24.04 LTS | arm-trusted-firmware | No fix yet | — |
| Ubuntu 22.04 LTS | arm-trusted-firmware | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | arm-trusted-firmware | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP6 | kernel-coco +3 | 6.4.0-15061.12.coco15sp6.1 | SUSE-SU-2025:0289-1 |
| SLES 12 SP5 | kernel-syms +2 | 4.12.14-122.244.1 | SUSE-SU-2025:0236-1 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLE Micro 6.1 | kernel-livepatch-MICRO-6-0-RT_Update_5 | 1-1.1 | SUSE-SU-2025:20249-1 |
| SLE Micro 6.1 | kernel-rt +1 | 6.4.0-25.1 | SUSE-SU-2025:20249-1 |
| SLE Micro 6.0 | kernel-livepatch-MICRO-6-0-RT_Update_5 | 1-1.1 | SUSE-SU-2025:20166-1 |
| SLE Micro 6.0 | kernel-rt +1 | 6.4.0-25.1 | SUSE-SU-2025:20166-1 |
| SLE Live Patching 15 SP6 | kernel-livepatch-SLE15-SP6-RT_Update_8 | 1-150600.1.3.1 | SUSE-SU-2025:0557-1 |
| SLE Live Patching 12 SP5 | kernel-default | 4.12.14-122.244.1 | SUSE-SU-2025:0236-1 |
| SLE Live Patching 12 SP5 | kgraft-patch-SLE12-SP5_Update_64 | 1-8.5.1 | SUSE-SU-2025:0236-1 |
| SUSE Real Time Module 15 SP6 | kernel-rt +3 | 6.4.0-150600.10.26.1 | SUSE-SU-2025:0557-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.6 | kernel-rt +3 | 6.4.0-150600.10.26.1 | SUSE-SU-2025:0557-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.21 | arm-trusted-firmware | 2.8.32-r0 | — |
| Alpine v3.20 | arm-trusted-firmware | 2.8.32-r0 | — |
| Alpine v3.19 | arm-trusted-firmware | 2.8.32-r0 | — |
| Alpine v3.18 | arm-trusted-firmware | 2.8.32-r0 | — |
Advisories 6
- SUSE-SU-2025:20166-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:20249-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:0557-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:0236-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:0289-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2025-0007 Samsung Exynos: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Jan 5, 2025