Intel

CVE-2022-23960

Certain Arm Cortex and Neoverse processors through 2022-03-08 do not properly restrict cache speculation, aka Spectre-BHB (CVE-2022-23960)

mediumEPSS 0.5%

Affected

  • android/:linux_kernel: :0..*
  • android/:linux_kernel: Kernel..*

Description

Certain Arm Cortex and Neoverse processors through 2022-03-08 do not properly restrict cache speculation, aka Spectre-BHB. An attacker can leverage the shared branch history in the Branch History Buffer (BHB) to influence mispredicted branches. Then, cache allocation can allow the attacker to obtain sensitive information.

Source: OSV (Open Source Vulnerabilities)NVD (NIST)cvelistv5

Affected operating systems

  • linux

    debian / debian_linux10.0

  • linux

    debian / debian_linux9.0

  • other

    arm / cortex-a57_firmware

  • other

    arm / cortex-a65_firmware

  • other

    arm / cortex-a65ae_firmware

  • other

    arm / cortex-a710_firmware

  • other

    arm / cortex-a72_firmware

  • other

    arm / cortex-a73_firmware

  • other

    arm / cortex-a75_firmware

  • other

    arm / cortex-a76_firmware

  • other

    arm / cortex-a76ae_firmware

  • other

    arm / cortex-a77_firmware

  • other

    arm / cortex-a78_firmware

  • other

    arm / cortex-a78ae_firmware

  • other

    arm / cortex-r7_firmware

  • other

    arm / cortex-r8_firmware

  • other

    arm / cortex-x1_firmware

  • other

    arm / cortex-x2_firmware

  • other

    arm / neoverse-e1_firmware

  • other

    arm / neoverse-v1_firmware

  • other

    arm / neoverse_n1_firmware

  • other

    arm / neoverse_n2_firmware

  • other

    xen / xen

Affected products

The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.

android:linux_kernel:
:0Kernel

Metrics

XIEM Effective CVSS
5.6
Source: nvd-v3
EPSS percentile
40.9 %
High — this CVE ranks above the median of all CVEs scored today (rank ≥ 36%).
KEV status
—
Show all metrics
Severity
medium
Priority score
43.26
Exploit maturity
no public PoC known
CVSS v3
5.6
EPSS score
0.5 %
Low — model estimates < 1% exploitation likelihood.
Published
2022-12-01 00:00 UTC

References & sources

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

  1. CVE Modified2026-10-08 22:17 UTC· cve@mitre.org
    • Reference: http://www.openwall.com/lists/oss-security/2022/03/18/2
    • Reference: https://developer.arm.com/support/arm-security-updates
    • Reference: https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability
    • Reference: https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html
  2. CVE Modified2026-10-08 22:17 UTC· 134c704f-9b21-4f2e-91b3-4a467353bcc0
    • SSVC: {"id":"CVE-2022-23960","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalI…
  3. CVE Modified2026-10-08 22:17 UTC· af854a3a-2127-422b-91ae-364da2661108
    • Reference: http://www.openwall.com/lists/oss-security/2022/03/18/2
    • Reference: https://developer.arm.com/support/arm-security-updates
    • Reference: https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability
    • Reference: https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html

Linked advisories