{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-64235","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-07-19T15:36:31.771Z","datePublished":"2026-07-24T15:27:40.814Z","dateUpdated":"2026-08-05T12:40:13.850Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T12:40:13.850Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nx86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines\n\nWith CONFIG_CALL_DEPTH_TRACKING enabled on an x86 retbleed-affected platform\n(eg: Skylake), with retbleed=stuff, registering a dynamic ftrace trampoline\ncrashes on the first call into the traced function:\n\n  BUG: unable to handle page fault for address: ffff88817ae18880\n  #PF: supervisor write access in kernel mode\n  #PF: error_code(0x0002) - not-present page\n  PGD 4b53067 P4D 4b53067 PUD 0\n  Oops: Oops: 0002 [#1] SMP PTI\n  CPU: 3 UID: 0 PID: 187 Comm: usleep Not tainted 7.0.10 #243 PREEMPT(full)\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.17.0-2-2 04/01/2014\n  Code: 24 78 00 00 00 00 48 89 ea 48 89 54 24 20 48 8b b4 24 b8 00 00 00 48 8b bc 24 b0 00 00 00 48 89 bc 24 80 00 00 00 48 83 ef 05 <65> 48 c1 3d 1f a8 b6 02 05 48 8b 15 f6 00 00 00 4c 89 3c 24 4c 89\n  Call Trace:\n   <TASK>\n   ? find_held_lock\n   ? exc_page_fault\n   ? lock_release\n   ? __x64_sys_clock_nanosleep\n   ? lockdep_hardirqs_on_prepare\n   ? trace_hardirqs_on\n   __x64_sys_clock_nanosleep\n   do_syscall_64\n   ? exc_page_fault\n   ? call_depth_return_thunk\n   entry_SYSCALL_64_after_hwframe\n  ...\n  Kernel panic - not syncing: Fatal exception\n\nThis small reproducer allows to easily trigger the crash:\n\n  # echo 'p __x64_sys_clock_nanosleep' > /sys/kernel/tracing/kprobe_events\n  # echo 1 > /sys/kernel/tracing/events/kprobes/p___x64_sys_clock_nanosleep_0/enable\n  # usleep 1\n\nMonitoring the crash under GDB points to the exact instruction in charge of\nincrementing the call depth:\n\n  sarq $5, %gs:__x86_call_depth(%rip)\n\nThis instruction matches the one inserted by the ftrace_regs_caller from\nftrace_64.S. This emitted code was likely working fine until the introduction\nof\n\n  59bec00ace28 (\"x86/percpu: Introduce %rip-relative addressing to PER_CPU_VAR()\"):\n\nit has made the call depth accounting addressing relative to $rip, instead of\nbeing based on an absolute address.\n\nAs this code exact location depends on where the trampoline lives in memory,\nthe corresponding displacement needs to be adjusted at runtime to actually\ncorrectly find the per-cpu __x86_call_depth value, otherwise the targeted\naddress is wrong, leading to the page fault seen above.\n\nFix the %rip-relative displacement of the copied CALL_DEPTH_ACCOUNT\ninstruction (from ftrace_regs_caller) by calling text_poke_apply_relocation(),\nas it is done for example by the x86 BPF JIT compiler through\nx86_call_depth_emit_accounting(). This corrects both CALL_DEPTH_ACCOUNT slots,\nin ftrace_caller and ftrace_regs_caller.\n\n  [ bp: Massage. ]"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:N - With a dynamic ftrace/kprobe trampoline monitoring a receive-path function such as tcp_v4_rcv, an unauthenticated remote attacker reaches the faulty trampoline by sending a valid network packet.\nAC:H - Exploitation requires an affected Intel x86 platform using the non-default retbleed=stuff mitigation and an active dynamic trampoline on attacker-reachable code, conditions normally outside the attacker's control.\nPR:N - In a preconfigured network-monitoring deployment, the attacker only sends packets and needs no credentials. Creating the probe is privileged through tracefs DAC or init-namespace capabilities, but deployed observability infrastructure can establish it beforehand.\nUI:N - Tracing may be enabled automatically by deployed monitoring infrastructure, and no human action is required when the attacker triggers the traced function.\nS:U - The erroneous access and resulting compromise occur within the host kernel's existing security authority without crossing a VM, IOMMU, or other scope boundary.\nC:H - The stale displacement causes an out-of-bounds 8-byte read-modify-write that can land in mapped direct-map RAM on sufficiently large systems; corruption of kernel objects can plausibly enable code execution and arbitrary kernel-memory disclosure.\nI:H - The sarq instruction writes to unrelated direct-map memory, and repeated invocations can corrupt kernel objects or control data, potentially enabling kernel control-flow hijacking.\nA:H - The documented first invocation produces a supervisor write page fault followed by a fatal kernel oops and panic, causing complete system unavailability."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["arch/x86/kernel/ftrace.c"],"versions":[{"version":"59bec00ace28d565ae0a68b23063ef3b961d82d5","lessThan":"8093442a2d1d4b42b9340a86023ccb2afb30b93a","status":"affected","versionType":"git"},{"version":"59bec00ace28d565ae0a68b23063ef3b961d82d5","lessThan":"d59cc66b702757e3c5a711e78a38583eac0c2738","status":"affected","versionType":"git"},{"version":"59bec00ace28d565ae0a68b23063ef3b961d82d5","lessThan":"9edff632ca216169846f8a63a5a3dc467e239c7a","status":"affected","versionType":"git"},{"version":"59bec00ace28d565ae0a68b23063ef3b961d82d5","lessThan":"a17dc12bfed8868e6a86f3b45c16065a70641acb","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["arch/x86/kernel/ftrace.c"],"versions":[{"version":"6.9","status":"affected"},{"version":"0","lessThan":"6.9","status":"unaffected","versionType":"semver"},{"version":"6.12.93","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.35","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.0.12","lessThanOrEqual":"7.0.*","status":"unaffected","versionType":"semver"},{"version":"7.1","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.9","versionEndExcluding":"6.12.93"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.9","versionEndExcluding":"6.18.35"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.9","versionEndExcluding":"7.0.12"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.9","versionEndExcluding":"7.1"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/8093442a2d1d4b42b9340a86023ccb2afb30b93a"},{"url":"https://git.kernel.org/stable/c/d59cc66b702757e3c5a711e78a38583eac0c2738"},{"url":"https://git.kernel.org/stable/c/9edff632ca216169846f8a63a5a3dc467e239c7a"},{"url":"https://git.kernel.org/stable/c/a17dc12bfed8868e6a86f3b45c16065a70641acb"}],"title":"x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines","x_generator":{"engine":"bippy-1.2.0"}}}}