CVE-2026-72028
Description
In the Linux kernel, the following vulnerability has been resolved: riscv: probes: save original sp in rethook trampoline Reading a word from the stack in a kretprobe crashes a risc-v kernel. $ cd /sys/kernel/tracing/ $ echo 'r n_tty_write $stack0' > dynamic_events $ echo 1 > events/kprobes/enable Unable to handle kernel paging request at virtual address 0000000200000128 ... [<ffffffff80016d16>] regs_get_kernel_stack_nth+0x26/0x38 [<ffffffff80177196>] process_fetch_insn+0x3ee/0x760 [<ffffffff80177836>] kretprobe_trace_func+0x116/0x1f0 [<ffffffff8017795a>] kretprobe_dispatcher+0x4a/0x58 [<ffffffff8013572e>] kretprobe_rethook_handler+0x5e/0x90 [<ffffffff80180838>] rethook_trampoline_handler+0x70/0x108 [<ffffffff8001ba32>] arch_rethook_trampoline_callback+0x12/0x1c [<ffffffff8001ba84>] arch_rethook_trampoline+0x48/0x94 [<ffffffff8067872a>] tty_write+0x1a/0x30 In regs_get_kernel_stack_nth, regs->sp contains an arbitrary value. arch_rethook_trampoline saves the registers from the probed function in a struct pt_regs. sp is not saved. Instead, sp is decremented for arch_rethook_trampoline's local stack. Fix this crash and save the original sp along with the other registers. Use a0 as a temporary register, it is overwritten anyway. [[email protected]: added Fixes tag; cc'ed stable]
How to fix
- Linux Linuxd21109fe4a55247094f913773a334772907cd016, 5da5cf48a432e30ded8d58087854e5383a36eff1, c386e1c591d72eab58ee2e69105c8cbc70928857, 2faf0198168d2017cb528a79f76c560fda3b6e94, 91b4d76dd07f1a1f20f73dfebb42ba04ac911a56, bc7b086a45521a986a49045907f017e3e46c763e or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | c22b0bcb1dd024cb9caad9230e3a387d8b061df5 ≤ v < d21109fe4a55247094f913773a334772907cd016, c22b0bcb1dd024cb9caad9230e3a387d8b061df5 ≤ v < 5da5cf48a432e30ded8d58087854e5383a36eff1, c22b0bcb1dd024cb9caad9230e3a387d8b061df5 ≤ v < c386e1c591d72eab58ee2e69105c8cbc70928857, c22b0bcb1dd024cb9caad9230e3a387d8b061df5 ≤ v < 2faf0198168d2017cb528a79f76c560fda3b6e94, c22b0bcb1dd024cb9caad9230e3a387d8b061df5 ≤ v < 91b4d76dd07f1a1f20f73dfebb42ba04ac911a56, c22b0bcb1dd024cb9caad9230e3a387d8b061df5 ≤ v < bc7b086a45521a986a49045907f017e3e46c763e, 5.12 | d21109fe4a55247094f913773a334772907cd016, 5da5cf48a432e30ded8d58087854e5383a36eff1, c386e1c591d72eab58ee2e69105c8cbc70928857, 2faf0198168d2017cb528a79f76c560fda3b6e94, 91b4d76dd07f1a1f20f73dfebb42ba04ac911a56, bc7b086a45521a986a49045907f017e3e46c763e |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.