CVE-2026-72028

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

riscv: probes: save original sp in rethook trampoline

Reading a word from the stack in a kretprobe crashes a risc-v kernel.

$ cd /sys/kernel/tracing/

$ echo 'r n_tty_write $stack0' > dynamic_events

$ echo 1 > events/kprobes/enable

Unable to handle kernel paging request at virtual address 0000000200000128

...

[<ffffffff80016d16>] regs_get_kernel_stack_nth+0x26/0x38

[<ffffffff80177196>] process_fetch_insn+0x3ee/0x760

[<ffffffff80177836>] kretprobe_trace_func+0x116/0x1f0

[<ffffffff8017795a>] kretprobe_dispatcher+0x4a/0x58

[<ffffffff8013572e>] kretprobe_rethook_handler+0x5e/0x90

[<ffffffff80180838>] rethook_trampoline_handler+0x70/0x108

[<ffffffff8001ba32>] arch_rethook_trampoline_callback+0x12/0x1c

[<ffffffff8001ba84>] arch_rethook_trampoline+0x48/0x94

[<ffffffff8067872a>] tty_write+0x1a/0x30

In regs_get_kernel_stack_nth, regs->sp contains an arbitrary value.

arch_rethook_trampoline saves the registers from the probe

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References