Executive brief
A vulnerability in the Linux kernel's x86 architecture support can cause a system crash (kernel panic) when using certain diagnostic or tracing tools. This occurs on specific Intel processors (like Skylake) where security mitigations for the 'Retbleed' hardware flaw are active. An attacker or a system administrator running tracing commands could trigger this to disrupt system availability.
Technical details
A flaw exists in the x86 ftrace implementation when CONFIG_CALL_DEPTH_TRACKING is enabled (typically for Retbleed mitigation on Skylake-era CPUs). The root cause is the use of %rip-relative addressing for per-CPU variables within dynamic ftrace trampolines. Because these trampolines are generated at runtime in various memory locations, the relative displacement to the '__x86_call_depth' variable becomes invalid if not adjusted. This results in a supervisor write access page fault and subsequent kernel panic when a traced function is called. The fix involves using 'text_poke_apply_relocation()' to correctly adjust the displacement at runtime.
Affected products
- Linux Linux Kernel x86 architecture with CONFIG_CALL_DEPTH_TRACKING enabled
Timeline
- 2026-05-27: disclosed: Initial patch submission
- 2026-06-09: patched: Patch committed to stable branches
- 2026-07-24: advisory: CVE published