A timing and cache side-channel vulnerability exists in OpenSSL's SM2 private key operations on ARM64 and RISC-V platforms due to a non-constant-time scalar multiplication implementation. This flaw allows attackers who can measure execution time or observe cache access patterns during SM2 signing or decryption to potentially learn secret scalar information. The issue affects OpenSSL versions 4.0, 3.6, 3.5, and 3.4 on these platforms. Versions 3.0, 1.1.1, and 1.0.2 are not affected. Fixed versions have been released to address this vulnerability.