Privilege escalation in Arm CPUs due to TLBI completion erratum

CVE-2025-10263 is a hardware vulnerability affecting multiple Arm CPU families, including Arm C1-Ultra, C1-Premium, Neoverse V3/V3AE, V2, V1, N2, N1, Cortex-X925, Cortex-X4/X3/X2/X1/X1C, Cortex-A710, Cortex-A78/A78AE/A78C, Cortex-A77, Cortex-A76/A76AE, and NVIDIA Olympus. The issue is an Arm TLBI-related erratum in which completion of affected memory accesses is not guaranteed by completion of a Translation Lookaside Buffer Invalidate (TLBI) sequence and associated DSB. Under specific timing and multi-processing conditions, a broadcast TLBI;DSB sequence can complete before writes translated by an affected TLB entry are globally observed. This can leave a transient window where stale translation or permission state is effectively still usable, allowing software to write to memory after page-table or stage-2 permissions have been changed to forbid writes. Arm describes the consequence as possible writes to resources owned by a higher exception level; Xen further notes possible bypass of Stage 1 translation, Stage 2 translation, or GPT protection.