High severity · published Jan 14, 2026
CVE-2025-0647
In certain Arm CPUs, a CPP RCTX instruction executed on one Processing Element (PE) may inhibit TLB invalidation when a TLBI is issued to the PE, either by the same PE or another…
7.9
CVSS
0.2%
EPSS
No
On KEV
Description
In certain Arm CPUs, a CPP RCTX instruction executed on one Processing Element (PE) may inhibit TLB invalidation when a TLBI is issued to the PE, either by the same PE or another PE in the shareability domain. In this case, the PE may retain stale TLB entries which should have been invalidated by the TLBI.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 6% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CF
C1-premium Firmware · Arm
All versions, or not specified · source: NVD
CF
C1-ultra Firmware · Arm
All versions, or not specified · source: NVD
CF
Cortex-a710 Firmware · Arm
All versions, or not specified · source: NVD
CF
Cortex-x2 Firmware · Arm
All versions, or not specified · source: NVD
CF
Cortex-x3 Firmware · Arm
All versions, or not specified · source: NVD
CF
Cortex-x4 Firmware · Arm
All versions, or not specified · source: NVD
CF
Cortex-x925 Firmware · Arm
All versions, or not specified · source: NVD
NF
Neoverse-n2 Firmware · Arm
All versions, or not specified · source: NVD
NF
Neoverse-v2 Firmware · Arm
All versions, or not specified · source: NVD
NF
Neoverse-v3 Firmware · Arm
All versions, or not specified · source: NVD
NF
Neoverse-v3ae Firmware · Arm
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-0647
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-0647
Vendor Advisory
https://developer.arm.com/documentation/111546
Third Party Advisory
https://graph.volerion.com/view?ID=CVE-2025-0647
More from C1-premium Firmware
5.1
CVE-2024-7881
An unprivileged context can trigger a data memory-dependent prefetch engine to fetch the contents of a privileged location and consume those contents as an address that is also…
