CVE-2026-72028

In the Linux kernel, the following vulnerability has been resolved:

riscv: probes: save original sp in rethook trampoline

Reading a word from the stack in a kretprobe crashes a risc-v kernel.

$ cd /sys/kernel/tracing/

$ echo 'r n_tty_write $stack0' > dynamic_events

$ echo 1 > events/kprobes/enable

Unable to handle kernel paging request at virtual address 0000000200000128

...

[<ffffffff80016d16>] regs_get_kernel_stack_nth+0x26/0x38

[<ffffffff80177196>] process_fetch_insn+0x3ee/0x760

[<ffffffff80177836>] kretprobe_trace_func+0x116/0x1f0

[<ffffffff8017795a>] kretprobe_dispatcher+0x4a/0x58

[<ffffffff8013572e>] kretprobe_rethook_handler+0x5e/0x90

[<ffffffff80180838>] rethook_trampoline_handler+0x70/0x108

[<ffffffff8001ba32>] arch_rethook_trampoline_callback+0x12/0x1c

[<ffffffff8001ba84>] arch_rethook_trampoline+0x48/0x94

[<ffffffff8067872a>] tty_write+0x1a/0x30

In regs_get_kernel_stack_nth, regs->sp contains an arbitrary value.

arch_rethook_trampoline saves the registers from the probed function in a

struct pt_regs. sp is not saved. Instead, sp is decremented for

arch_rethook_trampoline's local stack.

Fix this crash and save the original sp along with the other registers.

Use a0 as a temporary register, it is overwritten anyway.

[[email protected]: added Fixes tag; cc'ed stable]