CVE-2023-52750 is a vulnerability in the Linux kernel specifically affecting the arm64 architecture when compiled with certain versions of LLVM's integrated assembler prior to version 15.0.0. The issue arises due to incorrect byte-swapping of the NOP instruction for big-endian CPUs. This incorrect byte sequence inadvertently matches the encoding of the FNMADD instruction (floating-point fused multiply-add), which is not expected to be executed at that point. Prior to a specific kernel commit (34f66c4c4d5518c1), the kernel enabled FPSIMD (floating-point and SIMD) early during boot, masking the problem because the FNMADD instruction was not trapped. However, after this commit, FPSIMD is enabled later, causing the misencoded FNMADD instructions to trap during early boot, resulting in kernel panics and unhandled exceptions. This leads to potential corruption of user or kernel FPSIMD state and system instability. The vulnerability is mitigated by restricting the CONFIG_CPU_BIG_ENDIAN configuration to only use known good assemblers: GNU as or LLVM IAS 15.0.0 and newer, which correctly handle the byte-swapping. The vulnerability is technical and subtle, involving the interaction between assembler behavior, CPU endianness, and kernel initialization sequences on arm64 platforms. It affects Linux kernel versions built with vulnerable LLVM versions and configured for big-endian CPUs, which are less common but still relevant in certain embedded and specialized environments.

For European organizations, the impact of CVE-2023-52750 primarily concerns systems running Linux on arm64 big-endian hardware, which is relatively niche but present in some embedded systems, telecommunications infrastructure, and specialized industrial equipment. The vulnerability can cause kernel panics and system crashes during boot, leading to denial of service and potential data corruption in floating-point and SIMD registers. This can disrupt critical services, especially in environments relying on arm64 big-endian Linux systems for network infrastructure, industrial control, or telecommunications. While the vulnerability does not appear to allow privilege escalation or remote code execution directly, the resulting instability and kernel panics can cause significant operational disruption. European organizations using affected hardware and software stacks may face downtime, increased maintenance costs, and potential safety risks if embedded systems fail unexpectedly. The lack of known exploits in the wild reduces immediate risk, but the complexity of the issue means that unnoticed miscompilations could cause latent failures in deployed systems.

Mitigation requires ensuring that Linux kernels for arm64 big-endian systems are compiled only with GNU as or LLVM IAS version 15.0.0 or newer, which correctly handle the byte-swapping of NOP instructions. Organizations should audit their build environments and toolchains to confirm the assembler versions in use. Kernel configurations should restrict CONFIG_CPU_BIG_ENDIAN to these known good assemblers. Additionally, affected systems should be updated to Linux kernel versions that include the fix restricting CPU_BIG_ENDIAN usage. For embedded and industrial systems, vendors should provide updated firmware or kernel images compiled with safe toolchains. Testing and validation of boot sequences on affected hardware are critical to detect any latent issues. Monitoring for kernel panics or boot failures related to FPSIMD initialization can help identify affected systems. Since this vulnerability manifests during early boot, recovery procedures and fallback mechanisms should be reviewed to minimize downtime. Finally, organizations should engage with hardware and software vendors to ensure supply chain integrity and timely patch deployment.