Executive brief
The Linux kernel's RISC-V architecture implementation has a bug in the kretprobe (kernel return probe) handler that fails to correctly preserve the stack pointer when tracing function returns. This causes kernel panics with invalid memory access when users attempt to read stack values during kretprobe operations, making kernel debugging and tracing features unusable on RISC-V systems.
Technical details
The vulnerability is a register state management bug in arch_rethook_trampoline in the RISC-V kernel probes subsystem. When setting up the pt_regs structure for a kretprobe, the original stack pointer (sp) is not saved; instead, the struct pt_regs.sp field retains an arbitrary value, causing subsequent reads via regs_get_kernel_stack_nth() to access invalid kernel memory. The fix involves saving the original sp value by calculating the pre-decremented stack pointer and storing it in the pt_regs structure before the trampoline handler continues. The vulnerability is triggered when using dynamic_events to trace a function return with stack parameter access (e.g., '$stack0'). A patch is available in the Linux stable tree.
Affected products
- Linux Linux kernel versions with RISC-V kprobes support (from c22b0bcb1dd02)
Timeline
- 2026-08-15: disclosed
- 2026-07-24: patched: Upstream patch in Linux stable tree