Linux Kernel EUVD-2026-108812

Exploitation requires a Linux kernel built for the RISC-V architecture with CONFIG_SHADOW_CALL_STACK enabled - on that configuration gp is the shadow call stack pointer and load_global_pointer is a no-op, which is what makes the poisoned pointer dangerous. The attacker must already have local unprivileged code execution (CVSS PR:L) to run a task that writes the user-controllable tp register and then traps into the kernel. A practical limiting factor is that the attacker must learn the linear-map address of its own task_struct (&current); with KASLR enabled this requires brute forcing, which the researchers reported achieving in testing. Kernels not built with CONFIG_SHADOW_CALL_STACK, or non-RISC-V kernels, are not affected. Once gp is poisoned it is saved to task_struct.scs_sp, so the faulty reload is skipped on every subsequent entry, making the primitive persistent for that task.

The impact signals are severe: the description establishes an unprivileged, local attacker-to-kernel arbitrary-write and control-flow-hijack primitive, which the CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H vector (7.8) reflects with full C/I/A impact. However, exposure is sharply constrained by preconditions: the flaw only exists on RISC-V kernels built with CONFIG_SHADOW_CALL_STACK, so the vulnerable population is a small subset of all Linux deployments. This explains the low EPSS of 0.21% (11th percentile) and the absence of any KEV listing or public exploit - the SSVC-style priority label is 'this_week', consistent with a serious but non-emergency local-escalation bug rather than a mass-exploited remote one. A notable conflict: the input Tags label this 'Information Disclosure', but the description and the C:H/I:H/A:H vector describe a write/control-flow-hijack (privilege-escalation) primitive, not merely disclosure - the tag understates and mischaracterizes the impact. Net: a genuine high-severity local kernel privilege-escalation issue that warrants prompt patching on affected RISC-V/SCS systems, but not a broad internet-facing emergency given the local vector (AV:L) and narrow affected configuration.

An unprivileged local user on a RISC-V Linux system built with CONFIG_SHADOW_CALL_STACK sets the user-writable tp register to the linear-map address of its own task_struct (&current), brute-forced under KASLR, then triggers a trap. handle_exception() wrongly concludes the trap came from the kernel, skips reloading the shadow call stack pointer (gp), and continues using the attacker-controlled gp; subsequent non-leaf-function 'sd ra'/'ld ra' operations then write to and return through an attacker-chosen address, yielding kernel arbitrary write and control-flow hijack. No public exploit is identified at time of analysis, though the report notes the KASLR brute-force was demonstrated by the researchers in testing.