CVE-2026-72028: riscv: probes: save original sp in rethook trampoline
In the Linux kernel, the following vulnerability has been resolved:
riscv: probes: save original sp in rethook trampoline
Reading a word from the stack in a kretprobe crashes a risc-v kernel.
$ cd /sys/kernel/tracing/ $ echo 'r nttywrite $stack0' > dynamicevents $ echo 1 > events/kprobes/enable Unable to handle kernel paging request at virtual address 0000000200000128 ... [<ffffffff80016d16>] regsgetkernelstacknth+0x26/0x38 [<ffffffff80177196>] processfetchinsn+0x3ee/0x760 [<ffffffff80177836>] kretprobetracefunc+0x116/0x1f0 [<ffffffff8017795a>] kretprobedispatcher+0x4a/0x58 [<ffffffff8013572e>] kretproberethookhandler+0x5e/0x90 [<ffffffff80180838>] rethooktrampolinehandler+0x70/0x108 [<ffffffff8001ba32>] archrethooktrampolinecallback+0x12/0x1c [<ffffffff8001ba84>] archrethooktrampoline+0x48/0x94 [<ffffffff8067872a>] ttywrite+0x1a/0x30
In regsgetkernelstacknth, regs->sp contains an arbitrary value.
archrethooktrampoline saves the registers from the probed function in a struct ptregs. sp is not saved. Instead, sp is decremented for archrethooktrampoline's local stack.
Fix this crash and save the original sp along with the other registers. Use a0 as a temporary register, it is overwritten anyway.
[pjw@kernel.org: added Fixes tag; cc'ed stable]
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72028?
CVE-2026-72028 has been assigned a risk level of 34.
How do I fix CVE-2026-72028?
To fix CVE-2026-72028, update to the latest version of the Linux kernel that addresses this issue.
What systems are affected by CVE-2026-72028?
CVE-2026-72028 affects Linux kernel versions that implement the RISC-V architecture.
What is the impact of CVE-2026-72028?
The impact of CVE-2026-72028 is that it can cause a RISC-V kernel to crash when reading from the stack in a kretprobe.
When was CVE-2026-72028 published?
CVE-2026-72028 was published on August 15, 2026.