CVE-2026-72028

Received Received - Intake

Kernel Stack Read Crash in Linux RISC-V

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: riscv: probes: save original sp in rethook trampoline Reading a word from the stack in a kretprobe crashes a risc-v kernel. $ cd /sys/kernel/tracing/ $ echo 'r n_tty_write $stack0' > dynamic_events $ echo 1 > events/kprobes/enable Unable to handle kernel paging request at virtual address 0000000200000128 ... [<ffffffff80016d16>] regs_get_kernel_stack_nth+0x26/0x38 [<ffffffff80177196>] process_fetch_insn+0x3ee/0x760 [<ffffffff80177836>] kretprobe_trace_func+0x116/0x1f0 [<ffffffff8017795a>] kretprobe_dispatcher+0x4a/0x58 [<ffffffff8013572e>] kretprobe_rethook_handler+0x5e/0x90 [<ffffffff80180838>] rethook_trampoline_handler+0x70/0x108 [<ffffffff8001ba32>] arch_rethook_trampoline_callback+0x12/0x1c [<ffffffff8001ba84>] arch_rethook_trampoline+0x48/0x94 [<ffffffff8067872a>] tty_write+0x1a/0x30 In regs_get_kernel_stack_nth, regs->sp contains an arbitrary value. arch_rethook_trampoline saves the registers from the probed function in a struct pt_regs. sp is not saved. Instead, sp is decremented for arch_rethook_trampoline's local stack. Fix this crash and save the original sp along with the other registers. Use a0 as a temporary register, it is overwritten anyway. [pjw@kernel.org: added Fixes tag; cc'ed stable]

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72028

EUVD

EUVD-2026-58986

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability affects the Linux kernel on RISC-V systems. It occurs when using kretprobes, a kernel feature that probes function returns. The issue is that the stack pointer (sp) register is not properly saved when entering the trampoline handler for a probed function. This can lead to a kernel crash when the kernel tries to read from an invalid memory address on the stack.

Detection Guidance

This vulnerability affects the Linux kernel's riscv kretprobe handling. Detection requires kernel tracing tools. Run these commands as root: cd /sys/kernel/tracing/; echo 'r n_tty_write $stack0' > dynamic_events; echo 1 > events/kprobes/enable. Monitor for kernel crashes or 'Unable to handle kernel paging request' errors.

Impact Analysis

If you are running a vulnerable Linux kernel on RISC-V hardware and use kretprobes (e.g., for tracing or debugging), this flaw could cause system instability or crashes. It may lead to kernel panics or unexpected behavior when specific kernel functions are probed.

Compliance Impact

This vulnerability causes kernel crashes due to improper stack pointer handling in kretprobe probes, which could lead to denial-of-service conditions. Such instability may impact systems handling sensitive data, potentially violating availability requirements in GDPR and HIPAA. However, no direct evidence links this specific flaw to compliance violations.

Mitigation Strategies

Apply the kernel patch that saves the original stack pointer in the riscv rethook trampoline. Update to a fixed kernel version. If immediate patching isn't possible, disable kretprobe tracing for affected functions as a temporary workaround.

Hi! I’m here to help you understand CVE-2026-72028. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70