Loading story…
Arm disclosed CVE-2025-10263, a critical flaw in many Arm CPU cores that can let memory accesses complete incorrectly during permission changes, creating a path for writes to resources owned by a higher exception level. The issue stems from a timing condition in TLB invalidation handling where completion of a TLBI is not guaranteed to mean all affected memory accesses have completed, leaving stale translations usable across privilege boundaries. Affected processors include multiple Arm Neoverse and Cortex cores as well as NVIDIA Olympus, and the flaw has implications for Stage 1, Stage 2, and GPT protections used for memory isolation and virtualization.
Vendors and projects released coordinated advisories and patches after disclosure. Linux posted kernel fixes implementing Arm's software workaround, which adds an extra TLBI and DSB in certain invalidation paths, while NVIDIA issued a related mitigation for Olympus-based Vera CPUs. Xen published XSA-493 v2, warning that on multi-core Arm systems a malicious guest could potentially keep writing after Stage 2 permissions were changed, enabling hypervisor-level privilege escalation; patches were released for xen-unstable and supported stable branches from Xen 4.17 through 4.21. FreeBSD also issued an arm64 security advisory covering the hardware issue.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
NVIDIA confirmed that its Olympus cores used in the Vera CPU are affected by CVE-2025-10263. It also issued a related mitigation patch in response.
Arm reported that it submitted mitigation patches to Trusted Firmware-A for CVE-2025-10263, alongside its documented software workaround for affected processors. This adds firmware-level mitigation work beyond the Linux kernel patches already noted.
Linux kernel patches were posted to implement Arm's recommended mitigation for CVE-2025-10263. The patches address the TLBI completion issue that can permit writes across privilege boundaries under specific timing conditions.
Arm disclosed CVE-2025-10263 as a critical vulnerability affecting a broad range of Arm CPU cores. Arm said the issue stems from a timing condition during memory permission changes and published a workaround requiring an additional TLBI and DSB for certain TLB invalidations.
Xen Security Advisory XSA-493 version 2 publicly disclosed CVE-2025-10263 as a hardware-related Arm issue affecting multi-core Xen on Arm systems. Xen said the flaw could let a malicious guest write to memory after Stage 2 permissions were changed to forbid writes, enabling possible hypervisor-level privilege escalation, and provided patch sets for supported branches.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
9 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourcefreebsd.org
Open sourcephoronix.com
Open sourcexenbits.xen.org
Open sourcedeveloper.arm.com
Open sourcelore.kernel.org
Open sourcelore.kernel.org
Open sourceopennet.me
Open sourceopennet.ru
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Intel disclosed and patched several vulnerabilities affecting **Intel Xeon** server processors, including firmware and trusted execution flaws that can lead to **local privilege escalation** and, in one case, denial of service. In advisory **`INTEL-SA-01313`**, Intel said **`CVE-2025-20053`** and **`CVE-2025-24305`** affect multiple Xeon families, including 4th and 5th Gen Xeon Scalable, Xeon W2400/W3400, and some Xeon 6 products, with the bugs tied to **SGX** buffer handling and **ACTM** firmware control flow. Intel also noted **`CVE-2025-21090`** as a local denial-of-service issue and said the vulnerabilities were discovered internally, with mitigations delivered through firmware updates from system manufacturers. Intel separately issued **`INTEL-SA-01367`** for **Xeon 6 Birch Stream** processors, covering **`CVE-2025-26403`** and **`CVE-2025-32086`**, two high-severity flaws that affect systems using **`SGX`** or **`TDX`** and could let a privileged local user escalate privileges through out-of-bounds writes or improper security checks. Related reporting also highlighted additional Xeon 6 risks involving **OOB-MSM** access control (**`CVE-2025-22839`**), **TDX** memory-range overlap handling (**`CVE-2025-22889`**), and instruction-sequence-triggered privilege escalation (**`CVE-2025-22840`**), underscoring continued exposure in confidential computing and hardware management features. Intel released microcode and firmware mitigations and advised customers to install the latest updates from their OEM or system vendor.
Jun 29, 2026
Researchers disclosed the **Meltdown** and **Spectre** hardware flaws, showing that speculative execution in modern processors could let attackers read sensitive data across security boundaries on affected devices. Reuters reported that **Meltdown** primarily affected Intel processors by breaking memory isolation, while **Spectre** impacted Intel, AMD, and ARM chips by tricking applications into leaking secrets such as passwords and other protected data. CERT/CC later summarized the broader issue as cache side-channel attacks against CPU hardware using speculative execution, underscoring that the weakness was architectural rather than limited to a single product line. Major vendors and cloud providers moved to contain the fallout with software, firmware, and microcode mitigations, including Microsoft Azure protections for hosted customers and public advisories from manufacturers such as Huawei. Subsequent research showed the problem persisted beyond the initial disclosures: the **ZombieLoad** attacks demonstrated additional Intel data-leakage paths tied to speculative execution, and a later **TSX Asynchronous Abort (TAA)** variant affected some processors previously thought to be resistant. Intel issued microcode updates, but researchers and vendors warned that mitigations reduced rather than eliminated risk, that exploitation generally required local code execution, and that fully disabling the underlying CPU behavior would carry significant performance costs.
Jun 29, 2026
Xen disclosed **XSA-482** for **CVE-2026-31788**, a flaw in the Linux kernel's `privcmd` driver that can let an administrator inside an unprivileged Xen guest bypass kernel lockdown protections enforced under secure boot. The bug can be abused to perform actions on the guest kernel that should be blocked in secure mode, including modifying page tables in a way that could allow user mode to alter kernel memory. The issue affects Xen **PV, PVH, and HVM** guests running Linux with secure boot enabled. Xen said BSD-based systems are believed unaffected because they do not support secure boot in this context. The vulnerability was discovered by **Teddy Astie of Vates**, no mitigation is currently known, and remediation requires applying the published Linux patch set; the latest advisory revision notes that the flaw has now been assigned **`CVE-2026-31788`**.
Jun 29, 2026