Vulnerability-Lookup

FKIE_CVE-2026-64235

Vulnerability from fkie_nvd - Published: 2026-07-24 16:16 - Updated: 2026-11-08 16:10

Severity

8.1 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

In the Linux kernel, the following vulnerability has been resolved: x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines With CONFIG_CALL_DEPTH_TRACKING enabled on an x86 retbleed-affected platform (eg: Skylake), with retbleed=stuff, registering a dynamic ftrace trampoline crashes on the first call into the traced function: BUG: unable to handle page fault for address: ffff88817ae18880 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 4b53067 P4D 4b53067 PUD 0 Oops: Oops: 0002 [#1] SMP PTI CPU: 3 UID: 0 PID: 187 Comm: usleep Not tainted 7.0.10 #243 PREEMPT(full) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.17.0-2-2 04/01/2014 Code: 24 78 00 00 00 00 48 89 ea 48 89 54 24 20 48 8b b4 24 b8 00 00 00 48 8b bc 24 b0 00 00 00 48 89 bc 24 80 00 00 00 48 83 ef 05 <65> 48 c1 3d 1f a8 b6 02 05 48 8b 15 f6 00 00 00 4c 89 3c 24 4c 89 Call Trace: <TASK> ? find_held_lock ? exc_page_fault ? lock_release ? __x64_sys_clock_nanosleep ? lockdep_hardirqs_on_prepare ? trace_hardirqs_on __x64_sys_clock_nanosleep do_syscall_64 ? exc_page_fault ? call_depth_return_thunk entry_SYSCALL_64_after_hwframe ... Kernel panic - not syncing: Fatal exception This small reproducer allows to easily trigger the crash: # echo 'p __x64_sys_clock_nanosleep' > /sys/kernel/tracing/kprobe_events # echo 1 > /sys/kernel/tracing/events/kprobes/p___x64_sys_clock_nanosleep_0/enable # usleep 1 Monitoring the crash under GDB points to the exact instruction in charge of incrementing the call depth: sarq $5, %gs:__x86_call_depth(%rip) This instruction matches the one inserted by the ftrace_regs_caller from ftrace_64.S. This emitted code was likely working fine until the introduction of 59bec00ace28 ("x86/percpu: Introduce %rip-relative addressing to PER_CPU_VAR()"): it has made the call depth accounting addressing relative to $rip, instead of being based on an absolute address. As this code exact location depends on where the trampoline lives in memory, the corresponding displacement needs to be adjusted at runtime to actually correctly find the per-cpu __x86_call_depth value, otherwise the targeted address is wrong, leading to the page fault seen above. Fix the %rip-relative displacement of the copied CALL_DEPTH_ACCOUNT instruction (from ftrace_regs_caller) by calling text_poke_apply_relocation(), as it is done for example by the x86 BPF JIT compiler through x86_call_depth_emit_accounting(). This corrects both CALL_DEPTH_ACCOUNT slots, in ftrace_caller and ftrace_regs_caller. [ bp: Massage. ]

References

URL	Tags
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/8093442a2d1d4b42b9340a86023ccb2afb30b93a	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/9edff632ca216169846f8a63a5a3dc467e239c7a	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/a17dc12bfed8868e6a86f3b45c16065a70641acb	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/d59cc66b702757e3c5a711e78a38583eac0c2738	Patch

Impacted products

Vendor	Product	Version
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kernel/ftrace.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8093442a2d1d4b42b9340a86023ccb2afb30b93a",
              "status": "affected",
              "version": "59bec00ace28d565ae0a68b23063ef3b961d82d5",
              "versionType": "git"
            },
            {
              "lessThan": "d59cc66b702757e3c5a711e78a38583eac0c2738",
              "status": "affected",
              "version": "59bec00ace28d565ae0a68b23063ef3b961d82d5",
              "versionType": "git"
            },
            {
              "lessThan": "9edff632ca216169846f8a63a5a3dc467e239c7a",
              "status": "affected",
              "version": "59bec00ace28d565ae0a68b23063ef3b961d82d5",
              "versionType": "git"
            },
            {
              "lessThan": "a17dc12bfed8868e6a86f3b45c16065a70641acb",
              "status": "affected",
              "version": "59bec00ace28d565ae0a68b23063ef3b961d82d5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kernel/ftrace.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "639BA3A3-BBF8-4E67-95F9-1162C6691807",
              "versionEndExcluding": "6.12.93",
              "versionStartIncluding": "6.9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "0FCCB23A-7629-4386-93B6-B119237C4382",
              "versionEndExcluding": "6.18.35",
              "versionStartIncluding": "6.13",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "9161A938-0FA8-44BC-95FE-C5A271601AB3",
              "versionEndExcluding": "7.0.12",
              "versionStartIncluding": "6.19",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*",
              "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*",
              "matchCriteriaId": "E5910A9D-F60A-409A-B486-FE66BFEBA9B9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*",
              "matchCriteriaId": "81DFF19E-9CF8-49C6-8C36-1E4038622933",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines\n\nWith CONFIG_CALL_DEPTH_TRACKING enabled on an x86 retbleed-affected platform\n(eg: Skylake), with retbleed=stuff, registering a dynamic ftrace trampoline\ncrashes on the first call into the traced function:\n\n  BUG: unable to handle page fault for address: ffff88817ae18880\n  #PF: supervisor write access in kernel mode\n  #PF: error_code(0x0002) - not-present page\n  PGD 4b53067 P4D 4b53067 PUD 0\n  Oops: Oops: 0002 [#1] SMP PTI\n  CPU: 3 UID: 0 PID: 187 Comm: usleep Not tainted 7.0.10 #243 PREEMPT(full)\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.17.0-2-2 04/01/2014\n  Code: 24 78 00 00 00 00 48 89 ea 48 89 54 24 20 48 8b b4 24 b8 00 00 00 48 8b bc 24 b0 00 00 00 48 89 bc 24 80 00 00 00 48 83 ef 05 \u003c65\u003e 48 c1 3d 1f a8 b6 02 05 48 8b 15 f6 00 00 00 4c 89 3c 24 4c 89\n  Call Trace:\n   \u003cTASK\u003e\n   ? find_held_lock\n   ? exc_page_fault\n   ? lock_release\n   ? __x64_sys_clock_nanosleep\n   ? lockdep_hardirqs_on_prepare\n   ? trace_hardirqs_on\n   __x64_sys_clock_nanosleep\n   do_syscall_64\n   ? exc_page_fault\n   ? call_depth_return_thunk\n   entry_SYSCALL_64_after_hwframe\n  ...\n  Kernel panic - not syncing: Fatal exception\n\nThis small reproducer allows to easily trigger the crash:\n\n  # echo \u0027p __x64_sys_clock_nanosleep\u0027 \u003e /sys/kernel/tracing/kprobe_events\n  # echo 1 \u003e /sys/kernel/tracing/events/kprobes/p___x64_sys_clock_nanosleep_0/enable\n  # usleep 1\n\nMonitoring the crash under GDB points to the exact instruction in charge of\nincrementing the call depth:\n\n  sarq $5, %gs:__x86_call_depth(%rip)\n\nThis instruction matches the one inserted by the ftrace_regs_caller from\nftrace_64.S. This emitted code was likely working fine until the introduction\nof\n\n  59bec00ace28 (\"x86/percpu: Introduce %rip-relative addressing to PER_CPU_VAR()\"):\n\nit has made the call depth accounting addressing relative to $rip, instead of\nbeing based on an absolute address.\n\nAs this code exact location depends on where the trampoline lives in memory,\nthe corresponding displacement needs to be adjusted at runtime to actually\ncorrectly find the per-cpu __x86_call_depth value, otherwise the targeted\naddress is wrong, leading to the page fault seen above.\n\nFix the %rip-relative displacement of the copied CALL_DEPTH_ACCOUNT\ninstruction (from ftrace_regs_caller) by calling text_poke_apply_relocation(),\nas it is done for example by the x86 BPF JIT compiler through\nx86_call_depth_emit_accounting(). This corrects both CALL_DEPTH_ACCOUNT slots,\nin ftrace_caller and ftrace_regs_caller.\n\n  [ bp: Massage. ]"
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: x86/ftrace: Reubicar referencias percpu relativas a %rip en trampolines din\u00e1micos Con CONFIG_CALL_DEPTH_TRACKING habilitado en una plataforma x86 afectada por retbleed (ej: Skylake), con retbleed=stuff, registrar un trampoline ftrace din\u00e1mico falla en la primera llamada a la funci\u00f3n rastreada: BUG: no se puede manejar el fallo de p\u00e1gina para la direcci\u00f3n: ffff88817ae18880 #PF: acceso de escritura de supervisor en modo kernel #PF: error_code(0x0002) - p\u00e1gina no presente PGD 4b53067 P4D 4b53067 PUD 0 Oops: Oops: 0002 [#1] SMP PTI CPU: 3 UID: 0 PID: 187 Comm: usleep No contaminado 7.0.10 #243 PREEMPT(full) Nombre del hardware: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.17.0-2-2 04/01/2014 Code: 24 78 00 00 00 00 48 89 ea 48 89 54 24 20 48 8b b4 24 b8 00 00 00 48 8b bc 24 b0 00 00 00 48 89 bc 24 80 00 00 00 48 83 ef 05 menor que 65mayor que 48 c1 3d 1f a8 b6 02 05 48 8b 15 f6 00 00 00 4c 89 3c 24 4c 89 Traza de Llamadas: [TAREA] ? find_held_lock ? exc_page_fault ? lock_release ? __x64_sys_clock_nanosleep ? lockdep_hardirqs_on_prepare ? trace_hardirqs_on __x64_sys_clock_nanosleep do_syscall_64 ? exc_page_fault ? call_depth_return_thunk entry_SYSCALL_64_after_hwframe ... P\u00e1nico del kernel - no sincronizando: Excepci\u00f3n fatal Este peque\u00f1o reproductor permite activar f\u00e1cilmente el fallo: # echo \u2019p __x64_sys_clock_nanosleep\u2019 \u003e /sys/kernel/tracing/kprobe_events # echo 1 \u003e /sys/kernel/tracing/events/kprobes/p___x64_sys_clock_nanosleep_0/enable # usleep 1 Monitorizar el fallo bajo GDB apunta a la instrucci\u00f3n exacta encargada de incrementar la profundidad de llamada: sarq $5, %gs:__x86_call_depth(%rip) Esta instrucci\u00f3n coincide con la insertada por el ftrace_regs_caller de ftrace_64.S. Este c\u00f3digo emitido probablemente funcionaba bien hasta la introducci\u00f3n de 59bec00ace28 (\u2019x86/percpu: Introducir direccionamiento relativo a %rip en PER_CPU_VAR()\u2019): ha hecho que el direccionamiento de la contabilidad de la profundidad de llamada sea relativo a $rip, en lugar de basarse en una direcci\u00f3n absoluta. Como la ubicaci\u00f3n exacta de este c\u00f3digo depende de d\u00f3nde reside el trampoline en memoria, el desplazamiento correspondiente necesita ser ajustado en tiempo de ejecuci\u00f3n para encontrar realmente de forma correcta el valor __x86_call_depth por CPU; de lo contrario, la direcci\u00f3n objetivo es incorrecta, lo que lleva al fallo de p\u00e1gina visto anteriormente. Corregir el desplazamiento relativo a %rip de la instrucci\u00f3n CALL_DEPTH_ACCOUNT copiada (de ftrace_regs_caller) llamando a text_poke_apply_relocation(), como se hace, por ejemplo, por el compilador JIT BPF de x86 a trav\u00e9s de x86_call_depth_emit_accounting(). Esto corrige ambas ranuras CALL_DEPTH_ACCOUNT, en ftrace_caller y ftrace_regs_caller. [ bp: Ajustes. ]"
    }
  ],
  "id": "CVE-2026-64235",
  "lastModified": "2026-11-08T16:10:00.183",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 5.9,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-64235",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-10-16T15:37:47.446270Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-24T16:16:52.737",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/8093442a2d1d4b42b9340a86023ccb2afb30b93a"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/9edff632ca216169846f8a63a5a3dc467e239c7a"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/a17dc12bfed8868e6a86f3b45c16065a70641acb"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/d59cc66b702757e3c5a711e78a38583eac0c2738"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-476"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

CVE-2026-64235 (GCVE-0-2026-64235)

Vulnerability from cvelistv5 – Published: 2026-07-24 15:27 – Updated: 2026-10-19 20:28

Title

x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines

Summary

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 15:37 UTC

CWE

CWE-476 - NULL Pointer Dereference

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6639 records in the last 180 days details

References

4 references

URL	Tags
https://git.kernel.org/stable/c/8093442a2d1d4b42b…
https://git.kernel.org/stable/c/d59cc66b702757e3c…
https://git.kernel.org/stable/c/9edff632ca2161698…
https://git.kernel.org/stable/c/a17dc12bfed8868e6…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 59bec00ace28d565ae0a68b23063ef3b961d82d5 , < 8093442a2d1d4b42b9340a86023ccb2afb30b93a (git) Affected: 59bec00ace28d565ae0a68b23063ef3b961d82d5 , < d59cc66b702757e3c5a711e78a38583eac0c2738 (git) Affected: 59bec00ace28d565ae0a68b23063ef3b961d82d5 , < 9edff632ca216169846f8a63a5a3dc467e239c7a (git) Affected: 59bec00ace28d565ae0a68b23063ef3b961d82d5 , < a17dc12bfed8868e6a86f3b45c16065a70641acb (git)
Linux	Linux	Affected: 6.9 Unaffected: 0 , < 6.9 (semver) Unaffected: 6.12.93 , ≤ 6.12.* (semver) Unaffected: 6.18.35 , ≤ 6.18.* (semver) Unaffected: 7.0.12 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-64235",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:37:47.446270Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-476",
                "description": "CWE-476 NULL Pointer Dereference",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T20:28:16.189Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kernel/ftrace.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8093442a2d1d4b42b9340a86023ccb2afb30b93a",
              "status": "affected",
              "version": "59bec00ace28d565ae0a68b23063ef3b961d82d5",
              "versionType": "git"
            },
            {
              "lessThan": "d59cc66b702757e3c5a711e78a38583eac0c2738",
              "status": "affected",
              "version": "59bec00ace28d565ae0a68b23063ef3b961d82d5",
              "versionType": "git"
            },
            {
              "lessThan": "9edff632ca216169846f8a63a5a3dc467e239c7a",
              "status": "affected",
              "version": "59bec00ace28d565ae0a68b23063ef3b961d82d5",
              "versionType": "git"
            },
            {
              "lessThan": "a17dc12bfed8868e6a86f3b45c16065a70641acb",
              "status": "affected",
              "version": "59bec00ace28d565ae0a68b23063ef3b961d82d5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kernel/ftrace.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines\n\nWith CONFIG_CALL_DEPTH_TRACKING enabled on an x86 retbleed-affected platform\n(eg: Skylake), with retbleed=stuff, registering a dynamic ftrace trampoline\ncrashes on the first call into the traced function:\n\n  BUG: unable to handle page fault for address: ffff88817ae18880\n  #PF: supervisor write access in kernel mode\n  #PF: error_code(0x0002) - not-present page\n  PGD 4b53067 P4D 4b53067 PUD 0\n  Oops: Oops: 0002 [#1] SMP PTI\n  CPU: 3 UID: 0 PID: 187 Comm: usleep Not tainted 7.0.10 #243 PREEMPT(full)\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.17.0-2-2 04/01/2014\n  Code: 24 78 00 00 00 00 48 89 ea 48 89 54 24 20 48 8b b4 24 b8 00 00 00 48 8b bc 24 b0 00 00 00 48 89 bc 24 80 00 00 00 48 83 ef 05 \u003c65\u003e 48 c1 3d 1f a8 b6 02 05 48 8b 15 f6 00 00 00 4c 89 3c 24 4c 89\n  Call Trace:\n   \u003cTASK\u003e\n   ? find_held_lock\n   ? exc_page_fault\n   ? lock_release\n   ? __x64_sys_clock_nanosleep\n   ? lockdep_hardirqs_on_prepare\n   ? trace_hardirqs_on\n   __x64_sys_clock_nanosleep\n   do_syscall_64\n   ? exc_page_fault\n   ? call_depth_return_thunk\n   entry_SYSCALL_64_after_hwframe\n  ...\n  Kernel panic - not syncing: Fatal exception\n\nThis small reproducer allows to easily trigger the crash:\n\n  # echo \u0027p __x64_sys_clock_nanosleep\u0027 \u003e /sys/kernel/tracing/kprobe_events\n  # echo 1 \u003e /sys/kernel/tracing/events/kprobes/p___x64_sys_clock_nanosleep_0/enable\n  # usleep 1\n\nMonitoring the crash under GDB points to the exact instruction in charge of\nincrementing the call depth:\n\n  sarq $5, %gs:__x86_call_depth(%rip)\n\nThis instruction matches the one inserted by the ftrace_regs_caller from\nftrace_64.S. This emitted code was likely working fine until the introduction\nof\n\n  59bec00ace28 (\"x86/percpu: Introduce %rip-relative addressing to PER_CPU_VAR()\"):\n\nit has made the call depth accounting addressing relative to $rip, instead of\nbeing based on an absolute address.\n\nAs this code exact location depends on where the trampoline lives in memory,\nthe corresponding displacement needs to be adjusted at runtime to actually\ncorrectly find the per-cpu __x86_call_depth value, otherwise the targeted\naddress is wrong, leading to the page fault seen above.\n\nFix the %rip-relative displacement of the copied CALL_DEPTH_ACCOUNT\ninstruction (from ftrace_regs_caller) by calling text_poke_apply_relocation(),\nas it is done for example by the x86 BPF JIT compiler through\nx86_call_depth_emit_accounting(). This corrects both CALL_DEPTH_ACCOUNT slots,\nin ftrace_caller and ftrace_regs_caller.\n\n  [ bp: Massage. ]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - With a dynamic ftrace/kprobe trampoline monitoring a receive-path function such as tcp_v4_rcv, an unauthenticated remote attacker reaches the faulty trampoline by sending a valid network packet.\nAC:H - Exploitation requires an affected Intel x86 platform using the non-default retbleed=stuff mitigation and an active dynamic trampoline on attacker-reachable code, conditions normally outside the attacker\u0027s control.\nPR:N - In a preconfigured network-monitoring deployment, the attacker only sends packets and needs no credentials. Creating the probe is privileged through tracefs DAC or init-namespace capabilities, but deployed observability infrastructure can establish it beforehand.\nUI:N - Tracing may be enabled automatically by deployed monitoring infrastructure, and no human action is required when the attacker triggers the traced function.\nS:U - The erroneous access and resulting compromise occur within the host kernel\u0027s existing security authority without crossing a VM, IOMMU, or other scope boundary.\nC:H - The stale displacement causes an out-of-bounds 8-byte read-modify-write that can land in mapped direct-map RAM on sufficiently large systems; corruption of kernel objects can plausibly enable code execution and arbitrary kernel-memory disclosure.\nI:H - The sarq instruction writes to unrelated direct-map memory, and repeated invocations can corrupt kernel objects or control data, potentially enabling kernel control-flow hijacking.\nA:H - The documented first invocation produces a supervisor write page fault followed by a fatal kernel oops and panic, causing complete system unavailability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:40:13.850Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8093442a2d1d4b42b9340a86023ccb2afb30b93a"
        },
        {
          "url": "https://git.kernel.org/stable/c/d59cc66b702757e3c5a711e78a38583eac0c2738"
        },
        {
          "url": "https://git.kernel.org/stable/c/9edff632ca216169846f8a63a5a3dc467e239c7a"
        },
        {
          "url": "https://git.kernel.org/stable/c/a17dc12bfed8868e6a86f3b45c16065a70641acb"
        }
      ],
      "title": "x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64235",
    "datePublished": "2026-07-24T15:27:40.814Z",
    "dateReserved": "2026-07-19T15:36:31.771Z",
    "dateUpdated": "2026-10-19T20:28:16.189Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted