CVE-2026-72028
CVE-2026-72028 updated by NVD
Summary
In the Linux kernel, the following vulnerability has been resolved: riscv: probes: save original sp in rethook trampoline Reading a word from the stack in a kretprobe crashes a risc-v kernel. $ cd /sys/kernel/tracing/ $ echo 'r n_tty_write $stack0' > dynamic_events $ echo 1 > events/kprobes/enable Unable to handle kernel paging request at virtual address 0000000200000128 ... [ ] regs_get_kernel_stack_nth+0x26/0x38 [ ] process_fetch_insn+0x3ee/0x760 [ ] kretprobe_trace_func+0x116/0x1f0 [ ] kretprobe_dispatcher+0x4a/0x58 [ ] kretprobe_rethook_handler+0x5e/0x90 [ ] rethook_trampoline_handler+0x70/0x108 [ ] arch_rethook_trampoline_callback+0x12/0x1c [ ] arch_rethook_trampoline+0x48/0x94 [ ] tty_write+0x1a/0x30 In regs_get_kernel_stack_nth, regs->sp contains an arbitrary value. arch_rethook_trampoline saves the registers from the probed function in a struct pt_regs. sp is not saved. Instead, sp is decremented for arch_rethook_trampoline's local stack. Fix this crash and save the original sp along with the other registers. Use a0 as a temporary register, it is overwritten anyway. [[email protected]: added Fixes tag; cc'ed stable]
References
Includes data from the National Vulnerability Database (NIST). NVD data is in the public domain; this page is not endorsed by NIST.
CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.