← Vulnerability feed

Vulnerability record · CVE-2025-0647 · published 14 January 2026

CVE-2025-0647: Arm c1-ultra firmware vulnerability

Arm · C1 Ultra Firmware

In certain Arm CPUs, a CPP RCTX instruction executed on one Processing Element (PE) may inhibit TLB invalidation when a TLBI is issued to the PE, either by the same PE or another PE in the shareability domain. In this case, the PE may retain stale TLB entries which should have been invalidated by the TLBI.

7.9 CVSS 3.1 High EPSS 0.17% · top 94.3% CWE-226 · CWE-226
7.9CVSS 3.1 base score
0.17%EPSS exploitation probability, 30 days
NoNot in CISA KEV
11Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

In certain Arm CPUs, a CPP RCTX instruction executed on one Processing Element (PE) may inhibit TLB invalidation when a TLBI is issued to the PE, either by the same PE or another PE in the shareability domain. In this case, the PE may retain stale TLB entries which should have been invalidated by the TLBI.

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

Affected products

11 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://developer.arm.com/documentation/111546 Vendor Advisory
https://graph.volerion.com/view?ID=CVE-2025-0647 Third Party Advisory

Track CVE-2025-0647 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2024-5660Arm cortex-a710 firmware exposure of resource to wrong sphere vulnerabilityUse of Hardware Page Aggregation (HPA) and Stage-1 and/or Stage-2 translation on Cortex-A77, Cortex-A78, Cortex-A78C, Cortex-A78AE, Cortex-A710, Cort…EPSS 0.56%5.6CVE-2022-23960Xen vulnerabilityCertain Arm Cortex and Neoverse processors through 2022-03-08 do not properly restrict cache speculation, aka Spectre-BHB. An attacker can leverage t…EPSS 0.50%5.1CVE-2024-7881Arm c1-premium firmware observable discrepancy vulnerabilityAn unprivileged context can trigger a data memory-dependent prefetch engine to fetch the contents of a privileged location and consume those contents…EPSS 0.20%4.7CVE-2022-25368Amperecomputing ampere altra max firmware vulnerabilitySpectre BHB is a variant of Spectre-v2 in which malicious code uses the shared branch history (stored in the CPU BHB) to influence mispredicted branc…EPSS 0.30%

Source: NIST National Vulnerability Database (record CVE-2025-0647), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.