CVE-2026-64235

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines

With CONFIG_CALL_DEPTH_TRACKING enabled on an x86 retbleed-affected platform

(eg: Skylake), with retbleed=stuff, registering a dynamic ftrace trampoline

crashes on the first call into the traced function:

BUG: unable to handle page fault for address: ffff88817ae18880

#PF: supervisor write access in kernel mode

#PF: error_code(0x0002) - not-present page

PGD 4b53067 P4D 4b53067 PUD 0

Oops: Oops: 0002 [#1] SMP PTI

CPU: 3 UID: 0 PID: 187 Comm: usleep Not tainted 7.0.10 #243 PREEMPT(full)

Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.17.0-2-2 04/01/2014

Code: 24 78 00 00 00 00 48 89 ea 48 89 54 24 20 48 8b b4 24 b8 00 00 00 48 8b bc 24 b0 00 00 00 48 89 bc 24 80 00 00 00 48 83 ef 05 <65> 48 c1 3d 1f a8 b6 02 05 48 8b 15 f6 00 00 00 4c 89 3c 24 4c 89

Call Trace:

<TASK>

? find_held_lock

? exc_page_fau

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References