Linux Kernel CVE-2026-45876

The vulnerable code resides in the Linux kernel's arm64 GCS (Guarded Control Stack) subsystem, specifically in arch_set_shadow_stack_status() within the arm64 memory management layer. GCS is an ARMv9 architectural security feature that enforces hardware-backed shadow stacks to protect return addresses against control-flow attacks. The internal function alloc_gcs() calls do_mmap() to allocate the shadow stack region; do_mmap() signals failure by returning an error-encoded pointer via the ERR_PTR() convention rather than NULL. The existing check 'if (!ptr)' evaluates to false for these non-NULL error pointers, silently bypassing the error path and allowing the subsequent code to treat an invalid kernel address as a valid GCS. The correct idiom, IS_ERR_VALUE() or IS_ERR(), is already used consistently in the sibling function gcs_alloc_thread_stack() in the same subsystem. CWE-476 (Null Pointer Dereference) approximates the fault class, though the precise mechanism is an improper error-return check on a pointer-encoded error value rather than a true null dereference.