CVE-2026-72028riscv: probes: save original sp in rethook trampoline
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: riscv: probes: save original sp in rethook trampoline Reading a word from the stack in a kretprobe crashes a risc-v kernel. $ cd /sys/kernel/tracing/ $ echo 'r n_tty_write $stack0' > dynamic_events $ echo 1 > events/kprobes/enable Unable to handle kernel paging request at virtual address 0000000200000128 ... [<ffffffff80016d16>] regs_get_kernel_stack_nth+0x26/0x38 [<ffffffff80177196>] process_fetch_insn+0x3ee/0x760 [<ffffffff80177836>] kretprobe_trace_func+0x116/0x1f0 [<ffffffff8017795a>] kretprobe_dispatcher+0x4a/0x58 [<ffffffff8013572e>] kretprobe_rethook_handler+0x5e/0x90 [<ffffffff80180838>] rethook_trampoline_handler+0x70/0x108 [<ffffffff8001ba32>] arch_rethook_trampoline_callback+0x12/0x1c [<ffffffff8001ba84>] arch_rethook_trampoline+0x48/0x94 [<ffffffff8067872a>] tty_write+0x1a/0x30 In regs_get_kernel_stack_nth, regs->sp contains an arbitrary value. arch_rethook_trampoline saves the registers from the probed function in a struct pt_regs. sp is not saved. Instead, sp is decremented for arch_rethook_trampoline's local stack. Fix this crash and save the original sp along with the other registers. Use a0 as a temporary register, it is overwritten anyway. [pjw@kernel.org: added Fixes tag; cc'ed stable]
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from c22b0bcb1dd024cb9caad9230e3a387d8b061df5 before 5da5cf48a432e30ded8d58087854e5383a36eff1; from c22b0bcb1dd024cb9caad9230e3a387d8b061df5 before c386e1c591d72eab58ee2e69105c8cbc70928857; from c22b0bcb1dd024cb9caad9230e3a387d8b061df5 before 2faf0198168d2017cb528a79f76c560fda3b6e94; from c22b0bcb1dd024cb9caad9230e3a387d8b061df5 before 91b4d76dd07f1a1f20f73dfebb42ba04ac911a56; from c22b0bcb1dd024cb9caad9230e3a387d8b061df5 before bc7b086a45521a986a49045907f017e3e46c763e | CNA record |
References
- https://git.kernel.org/stable/c/5da5cf48a432e30ded8d58087854e5383a36eff1
- https://git.kernel.org/stable/c/c386e1c591d72eab58ee2e69105c8cbc70928857
- https://git.kernel.org/stable/c/2faf0198168d2017cb528a79f76c560fda3b6e94
- https://git.kernel.org/stable/c/91b4d76dd07f1a1f20f73dfebb42ba04ac911a56
- https://git.kernel.org/stable/c/bc7b086a45521a986a49045907f017e3e46c763e
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.