Executive brief
A vulnerability was identified in the Linux kernel's Guarded Control Stack (GCS) for ARM64 processors, which is a security feature designed to prevent certain types of cyberattacks. Due to a coding error, the system might fail to properly handle memory allocation failures when setting up this security feature. This could potentially lead to system instability or the use of invalid memory addresses, though it is primarily a reliability and correctness issue within the kernel.
Technical details
The vulnerability exists in the arch_set_shadow_stack_status() function within arch/arm64/mm/gcs.c. The function alloc_gcs() returns an error-encoded pointer (via do_mmap()) rather than NULL upon failure. However, the original code performed a NULL check (!gcs), failing to catch actual error returns. This logic error could lead the kernel to treat an error code as a valid memory address for the Guarded Control Stack. The fix replaces the NULL check with IS_ERR_VALUE() to correctly identify and propagate allocation errors. This issue affects ARM64 systems utilizing GCS shadow stacks.
Affected products
- Linux Linux kernel arm64 architecture
Timeline
- 2026-02-02: other: Patch authored
- 2026-05-27: disclosed: CVE published
- 2026-05-27: advisory: NVD record created