SB20261023147 - Reliance on Untrusted Inputs in a Security Decision in Linux kernel riscv kernel

Description

This security bulletin contains information about 1 vulnerability.

1) Reliance on Untrusted Inputs in a Security Decision (CVE-ID: CVE-2026-99018)

CWE-ID: CWE-807 - Reliance on Untrusted Inputs in a Security Decision

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to write to arbitrary kernel memory and hijack kernel control flow to execute arbitrary code with kernel privileges.

The vulnerability exists due to reliance on a user-controlled register for a security decision in the Linux kernel RISC-V handle_exception() shadow call stack handling when entering the kernel from userspace. A local user can set tp to the linear-map address of the current task_struct and supply a malicious gp value before triggering a trap to bypass the shadow call stack pointer reload, causing kernel functions to write return addresses to attacker-controlled memory and return through attacker-controlled addresses.

Exploitation requires CONFIG_SHADOW_CALL_STACK to be enabled.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/37b4401ee6fa06046446d55e97e8d11784080843
• https://git.kernel.org/stable/c/4d0697f192975dab5985e921989be1d85cf580e9
• https://git.kernel.org/stable/c/6639735367a7d491977e9e5e7afc50b489d81d83
• https://git.kernel.org/stable/c/7d1367a53137e379498eb8791295e58854378636