High severity · published Jan 14, 2026
CVE-2025-0647
In certain Arm CPUs, a CPP RCTX instruction executed on one Processing Element (PE) may inhibit TLB invalidation when a TLBI is issued to the PE, either by the same PE or another…
7.9
CVSS
0.2%
EPSS
No
On KEV
Description
In certain Arm CPUs, a CPP RCTX instruction executed on one Processing Element (PE) may inhibit TLB invalidation when a TLBI is issued to the PE, either by the same PE or another PE in the shareability domain. In this case, the PE may retain stale TLB entries which should have been invalidated by the TLBI.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 6% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
C1
C1-Premium · Arm
0 · source: vendor
C1
C1-Ultra · Arm
0 · source: vendor
CO
Cortex-A710 · Arm
0 · source: vendor
CO
Cortex-X2 · Arm
0 · source: vendor
CO
Cortex-X3 · Arm
0 · source: vendor
CO
Cortex-X4 · Arm
0 · source: vendor
CO
Cortex-X925 · Arm
0 · source: vendor
NE
Neoverse-N2 · Arm
0 · source: vendor
NE
Neoverse-V2 · Arm
0 · source: vendor
NE
Neoverse-V3 · Arm
0 · source: vendor
NE
Neoverse-V3AE · Arm
0 · source: vendor
CF
C1-premium Firmware · Arm
All versions, or not specified · source: NVD
Affected product
C1
C1-Premium
Arm
More from C1-Premium
9.1
CVE-2025-10263
Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710,…
5.1
CVE-2024-7881
An unprivileged context can trigger a data memory-dependent prefetch engine to fetch the contents of a privileged location and consume those contents as an address that is also…