Old versions of CMSIS had a weird "only for use with ARM hardware" license header, which also carried through into most BSPs. I don't think this was resolved until around CMSIS 4, so it might just be a matter of front porting since it looks like normal STM32 stuff which is mostly permissively licensed now.