{"apiVersion":"1.0","identifier":"CVE-2026-72028","description":"In the Linux kernel, the following vulnerability has been resolved: riscv: probes: save original sp in rethook trampoline Reading a word from the stack in a kretprobe crashes a risc-v kernel. $ cd /sys/kernel/tracing/ $ echo -r n_tty_write $stack0- > dynamic_events $ echo 1 > events/kprobes/enable Unable to handle kernel paging request at virtual address 0000000200000128 ... [<ffffffff80016d16>] regs_get_kernel_stack_nth+0x26/0x38 [<ffffffff80177196>] process_fetch_insn+0x3ee/0x760 [<ffffffff80177836>] kretprobe_trace_func+0x116/0x1f0 [<ffffffff8017795a>] kretprobe_dispatcher+0x4a/0x58 [<ffffffff8013572e>] kretprobe_rethook_handler+0x5e/0x90 [<ffffffff80180838>] rethook_trampoline_handler+0x70/0x108 [<ffffffff8001ba32>] arch_rethook_trampoline_callback+0x12/0x1c [<ffffffff8001ba84>] arch_rethook_trampoline+0x48/0x94 [<ffffffff8067872a>] tty_write+0x1a/0x30 In regs_get_kernel_stack_nth, regs->sp contains an arbitrary value. arch_rethook_trampoline saves the registers from the probed function in a struct pt_regs. sp is not saved. Instead, sp is decremented for arch_rethook_trampoline-s local stack. Fix this crash and save the original sp along with the other registers. Use a0 as a temporary register, it is overwritten anyway. [pjw@kernel.org: added Fixes tag; cc-ed stable]","publishedAt":"2026-08-15T06:21:01","lastModifiedAt":"2026-08-17T06:18:00","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-72028","cvssScore":null,"cvssVector":"Pending","epssProbability":0.002,"riskScore":0,"affectedProduct":"Linux kernel","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-72028","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-72028","en":"https://www.redsauce.net/en/cves/CVE-2026-72028","fr":"https://www.redsauce.net/fr/cves/CVE-2026-72028","pt":"https://www.redsauce.net/pt/cves/CVE-2026-72028","de":"https://www.redsauce.net/de/cves/CVE-2026-72028","sk":"https://www.redsauce.net/sk/cves/CVE-2026-72028","el":"https://www.redsauce.net/el/cves/CVE-2026-72028"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-72028"}}