Arm CPU Cores CVE-2025-10263

No vendor-released patch identified at time of analysis as a single firmware artifact - Arm's developer.arm.com/documentation/112137 advisory should be consulted per core to obtain the relevant errata workaround sequence, and SoC vendors (Qualcomm, MediaTek, NVIDIA, Ampere, AWS Graviton OEMs, etc.) will need to ship updated firmware or microcode/erratum software workarounds incorporating that guidance. Hypervisor operators should track and apply the Xen XSA-493 fix (http://xenbits.xen.org/xsa/advisory-493.html) and equivalent updates for KVM/Hyper-V on Arm as they become available. Until per-platform updates ship, compensating controls include restricting the ability to execute untrusted code at EL0/EL1 on affected hosts (avoid running untrusted guest VMs or untrusted containers on shared Neoverse hardware), pinning sensitive workloads to unaffected cores where heterogeneous SoCs allow, and monitoring vendor security bulletins for SoC-specific firmware updates; note that workload pinning reduces capacity and the guest-restriction control is incompatible with multi-tenant cloud or shared-VDI models.