CVE-2025-71102

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

scs: fix a wrong parameter in __scs_magic

__scs_magic() needs a 'void *' variable, but a 'struct task_struct *' is

given. 'task_scs(tsk)' is the starting address of the task's shadow call

stack, and '__scs_magic(task_scs(tsk))' is the end address of the task's

shadow call stack. Here should be '__scs_magic(task_scs(tsk))'.

The user-visible effect of this bug is that when CONFIG_DEBUG_STACK_USAGE

is enabled, the shadow call stack usage checking function

(scs_check_usage) would scan an incorrect memory range. This could lead

1. **Inaccurate stack usage reporting**: The function would calculate

wrong usage statistics for the shadow call stack, potentially showing

incorrect value in kmsg.

2. **Potential kernel crash**: If the value of __scs_magic(tsk)is

greater than that of __scs_magic(task_scs(tsk)), the for loop may

access unmapped memory, potentially causing a kernel panic. However,

this scenario

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References