The vulnerability in the cmov crate affects the aarch64 backend implementations of Cmov and CmovEq functions. These implementations assume that when loading smaller-than-register-sized values into registers, the upper bits are zero-extended. However, the Rust inline assembly reference states these upper bits are undefined, leading to incorrect conditional move behavior when high bits are set. For example, a condition cast from u32 to u8 may still have high bits set in the register, causing the conditional select (csel) instruction to choose the wrong value. The issue affects versions >=0.1.1 and <0.5.4 of the cmov crate. The problem is demonstrated with failing test cases on aarch64 Linux compiled with Rust 1.94.0. The bug was introduced in the aarch64 backend and relates to how inline assembly operands are handled. The impact is limited to specific usage patterns where narrowing casts mask bits in Rust but not in assembly.

This vulnerability can cause the Cmov and CmovEq functions on aarch64 to produce incorrect outputs under certain conditions where high bits of registers are set unexpectedly. This may lead to logical errors in software relying on these conditional move operations, potentially causing incorrect program behavior. The impact is limited to the affected versions of the cmov crate on aarch64 platforms and depends on whether the calling code triggers the problematic conditions. There are no reports of known exploits in the wild.

No official patch or fix is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory or the cmov crate repository for current remediation guidance. Users should avoid relying on the affected versions (>=0.1.1 <0.5.4) of the cmov crate on aarch64 until a fix is released. Review usage of Cmov and CmovEq functions in code to assess potential impact. Consider applying manual workarounds that ensure proper zero-extension of smaller values before passing them to these functions.