Executive brief
The Linux kernel contains a bug in the C-SKY architecture's system call tracing code that causes the 5th and 6th arguments to syscalls to be read from the wrong memory locations. This leads to traced system calls (those monitored by debuggers or security tools via PTRACE_SYSCALL) receiving corrupted argument values, potentially causing those calls to fail or behave unexpectedly. For example, memory mapping operations may fail when traced, affecting any debugger or intrusion detection system monitoring syscalls on C-SKY systems.
Technical details
The vulnerability is a register/argument ordering bug in the C-SKY ABIv2 syscall_trace code path. When the kernel reloads syscall arguments from pt_regs before invoking the syscall handler, it adjusts the stack pointer (sp) before loading the 5th and 6th arguments (LSAVE_A4 and LSAVE_A5). Since these offsets are relative to the original pt_regs base, reading them after sp modification fetches values from incorrect stack slots, corrupting the arguments. The bug is triggered when a process is traced via PTRACE_SYSCALL, affecting any syscall with 5+ arguments (e.g., mmap2). The fix reorders the assembly instructions to load a4/a5 before adjusting sp. This is a logic error in syscall argument handling with no network exposure; exploitation requires local execution and tracing capability.
Affected products
- Linux Linux kernel 4.19.15 and other versions with C-SKY ABIv2 syscall trace implementation
Timeline
- 2026-05-22: patched: Patch authored by Hanlin Song