Executive brief
A flaw in the Linux kernel's rethook trampoline on LoongArch processors can corrupt the percpu base register when a task is migrated between CPUs during scheduler preemption. This causes kernel data structure corruption (scheduler queues, RCU state, timer programming), leading to system instability including hard lockups, wrong-CPU warnings, and CPUs becoming stuck in the idle loop.
Technical details
The vulnerability is a register poisoning issue in the LoongArch rethook trampoline handler. The trampoline saves and restores the $r21 register (the percpu base) across handler execution, but rethook_trampoline_handler() may trigger preemption via preempt_enable_notrace(). If the task migrates to a different CPU between save and restore, the saved $r21 value reflects the old CPU's percpu base. When restored on the new CPU, this corrupts all subsequent this_cpu_*() accesses to kernel-critical per-CPU structures (runqueues, RCU data, timers, FPU ownership). The fix is to remove both the save and restore of $r21, since the register is guaranteed to hold the correct value at trampoline exit under the existing kernel convention (SAVE_SOME/RESTORE_SOME only reload it on user-mode transitions). The flaw existed since v6.3 in the pre-rethook kretprobe trampoline and was carried over when rethook replaced it.
Affected products
- Linux Linux kernel v6.3 and later
Timeline
- 2026-09-16: disclosed