CVE-2026-72028 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
riscv: probes: save original sp in rethook trampoline
Reading a word from the stack in a kretprobe crashes a risc-v kernel.
$ cd /sys/kernel/tracing/ $ echo 'r n_tty_write $stack0' > dynamic_events $ echo 1 > events/kprobes/enable Unable to handle kernel paging request at virtual address 0000000200000128 ... [<ffffffff80016d16>] regs_get_kernel_stack_nth+0x26/0x38
[<ffffffff80177196>] process_fetch_insn+0x3ee/0x760
[<ffffffff80177836>] kretprobe_trace_func+0x116/0x1f0
[<ffffffff8017795a>] kretprobe_dispatcher+0x4a/0x58
[<ffffffff8013572e>] kretprobe_rethook_handler+0x5e/0x90
[<ffffffff80180838>] rethook_trampoline_handler+0x70/0x108
[<ffffffff8001ba32>] arch_rethook_trampoline_callback+0x12/0x1c
[<ffffffff8001ba84>] arch_rethook_trampoline+0x48/0x94
[<ffffffff8067872a>] tty_write+0x1a/0x30
In regs_get_kernel_stack_nth, regs->sp contains an arbitrary value.
arch_rethook_trampoline saves the registers from the probed function in a struct pt_regs. sp is not saved. Instead, sp is decremented for arch_rethook_trampoline's local stack.
Fix this crash and save the original sp along with the other registers. Use a0 as a temporary register, it is overwritten anyway.
[[email protected]: added Fixes tag; cc'ed stable]
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/15/2026
This vulnerability affects the riscv architecture implementation within the linux kernel's kprobes subsystem, specifically in the kretprobe functionality that monitors function returns. The issue manifests when attempting to read stack values through dynamic events in the kernel tracing framework, causing a kernel paging fault at virtual address 0000000200000128. The crash occurs during the execution of kretprobe_trace_func which processes return probes, ultimately failing in the rethook_trampoline_handler and arch_rethook_trampoline_callback functions.
The root cause lies in the improper handling of stack pointers within the riscv architecture's rethook trampoline mechanism. When arch_rethook_trampoline executes, it saves registers from the probed function into a struct pt_regs structure but fails to preserve the original stack pointer value. Instead, the stack pointer is modified for local trampoline operations without saving the original value, leading to invalid memory access when subsequent code attempts to read from the saved stack location. This flaw directly corresponds to cwe-248, an unspecified platform error that occurs when a program fails to properly handle register state during function call interception.
The operational impact of this vulnerability is significant for systems utilizing riscv architecture with kernel tracing capabilities enabled. Any attempt to use kretprobe dynamic events on functions like n_tty_write will result in immediate kernel crashes, effectively rendering the system unstable and potentially causing complete system failures. The vulnerability represents a critical memory safety issue that allows for arbitrary code execution or system compromise through controlled stack pointer manipulation. This aligns with attack techniques described in the attack pattern taxonomy where improper handling of register state during function interception can lead to privilege escalation and system instability.
Mitigation strategies should focus on implementing proper stack pointer preservation within the riscv architecture's rethook trampoline implementation. The fix involves saving the original stack pointer value alongside other registers in the pt_regs structure before modifying it for local operations. By utilizing register a0 as a temporary storage location that gets overwritten anyway, the solution maintains compatibility while ensuring proper state preservation. This approach addresses the underlying architectural flaw and prevents the kernel from attempting to access invalid memory addresses during kretprobe operation. The vulnerability fix also incorporates proper version control tagging through the fixes tag mechanism to ensure appropriate patching across different kernel versions.