Executive brief
A vulnerability has been identified in the Linux kernel affecting systems using the RISC-V processor architecture. The issue occurs when the system attempts to inspect the activity of background tasks, which can trigger an internal error or potentially allow unauthorized access to sensitive information. This could lead to system instability or a breach of data confidentiality. Patches have been released to ensure the kernel safely handles these background task inspections.
Technical details
A vulnerability exists in the RISC-V stacktrace implementation within the Linux kernel (arch/riscv/kernel/stacktrace.c). When the kernel attempts to unwind the stack of a task other than the currently executing one, KASAN (Kernel Address Sanitizer) may report an out-of-bounds access in walk_stackframe. This occurs because a task running on a different CPU could modify or poison its own stack while another CPU is attempting to read it. An attacker with local access could potentially exploit this race condition to cause a denial of service (kernel panic) or read sensitive kernel memory. The fix involves implementing READ_ONCE_NOCHECK when accessing stacks of non-current tasks to bypass KASAN instrumentation in these specific scenarios, mirroring a previous fix for the x86 architecture. Patches are available in various stable kernel branches including 6.1.y, 6.6.y, and 6.12.y.
Affected products
- Linux Linux 4.15 to 6.1.167, 6.6.117, 6.12.58, 6.17.8
Timeline
- 2025-12-16: advisory: NVD Published Date
- 2025-10-27: patched: Initial fix commit by Paul Walmsley
References
- https://git.kernel.org/stable/c/060ea84a484e852b52b938f234bf9b5503a6c910
- https://git.kernel.org/stable/c/27379fcc15a10d3e3780fe79ba3fc7ed1ccd78e2
- https://git.kernel.org/stable/c/2c8d2b53866fb229b438296526ef0fa5a990e5e5
- https://git.kernel.org/stable/c/ef4d626ac59a56f8ec5cc09c1fef26f2923eec6f
- https://git.kernel.org/stable/c/f34ba22989da61186f30a40b6a82e0b3337b96fc