{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-89903", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-11T19:38:34.774Z", "datePublished": "2026-09-16T10:32:03.038Z", "dateUpdated": "2026-09-16T14:39:51.967Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-09-16T14:39:51.967Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: Do not save/restore percpu base register in rethook trampoline\n\nThe rethook trampoline saves $r21 ($u0), the percpu base, into its frame\nat entry and restores it at exit. Inbetween rethook_trampoline_handler()\nmay schedule via preempt_enable_notrace().\n\nIf the task migrates to another CPU, the frame's $r21 holds the old\nCPU's percpu base, and restoring it poisons $r21 on the new CPU. Until\nthe next user->kernel transition heals $r21, all this_cpu_*() accesses\n(runqueues, RCU per-CPU data, timer tick programming, FPU ownership)\nhit the wrong CPU's percpu area.\n\nUnder kretprobe-heavy preemptible load this can corrupt scheduler and\ntimer state: scheduling-while-atomic splats, wrong-CPU RCU warnings,\nWARN_ON_ONCE(rq != this_rq()) in nohz_balance_exit_idle(), and CPUs\nparking in the idle loop with the constant timer never re-armed (hard\nlockup). Reproduces on a Loongson-3A6000 with kretprobes on VFS paths\nplus heavy file churn (OS install / unsquashfs).\n\nBy convention $r21 always holds the current CPU's percpu base in kernel\nmode: SAVE_SOME() at exception entry reloads it only when coming from\nuser mode, and RESTORE_SOME() restores it only when returning to user\nmode; the context-switch path never writes it. Therefore the live $r21\nat trampoline exit is already correct, and nothing inbetween can change\nit legitimately (kernel C code cannot write a global register variable).\nThe same flaw existed even in the pre-rethook kretprobe trampoline since\nv6.3; it was carried over when rethook replaced it. Drop both the save\nand the restore here. Drop the restore is enough to solve the issue, and\ndrop the save is to keep the code tidy and no need to clear it."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The rethook trampoline runs only after a locally installed kretprobe fires on a kernel function return (tracefs kprobe_events, perf kprobe PMU, or BPF kretprobe). It is not reached by receiving network packets or by a network-server protocol parser.\nAC:L - The attacker installs a kretprobe on a function they call (e.g. VFS) and forces the migration window: a helper thread can sched_setaffinity or generate preemption so preempt_enable_notrace() in rethook_trampoline_handler() reschedules onto another CPU before $r21 is restored.\nPR:L - Creating kretprobes via kprobe_events checks only LOCKDOWN_TRACEFS and DAC (0640), not capable(); tracing-group gid mounts on Android/ChromeOS/dev systems grant this to unprivileged users. CAP_BPF/CAP_PERFMON for BPF kretprobe attach are likewise Low because BPF tokens can delegate them.\nUI:N - The attacker installs and enables the kretprobe, then triggers matching returns and CPU migration from their own threads. No separate victim mount, click, or other interactive action is required.\nS:U - Restoring a stale percpu base corrupts this kernel's per-CPU areas (runqueues, RCU, timers, FPU owner) on the same host. That is in-kernel memory corruption, not a guest-to-host, IOMMU, or sandbox boundary crossing.\nC:H - Poisoned $r21 makes this_cpu_read() fetch another CPU's per-CPU data, including FPU ownership used to decide whether to save/restore vector state, so register contents can leak across tasks. Kernel memory corruption of this kind is a High confidentiality primitive.\nI:H - this_cpu_write() and related RMWs then modify the other CPU's scheduler, timer, and RCU per-CPU objects, including structures that hold function pointers (timer callbacks, sched class). That is kernel memory corruption enabling integrity loss and control-flow hijack.\nA:H - The same wrong-CPU accesses cause scheduling-while-atomic splats, wrong-CPU RCU warnings, rq != this_rq() WARNs, and idle CPUs whose constant timer is never re-armed, producing oops, panic, or hard lockup as documented in the fix."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/loongarch/kernel/rethook_trampoline.S"], "versions": [{"version": "3f5536860086d906b01ec5ed68cf50c7edcc40af", "lessThan": "a03b5e7483ad2c33ba5dd2adb8552e84bfee8fe2", "status": "affected", "versionType": "git"}, {"version": "3f5536860086d906b01ec5ed68cf50c7edcc40af", "lessThan": "8f15e95b438bc6b3c9f23a33c9a0d0678ebd1dc8", "status": "affected", "versionType": "git"}, {"version": "3f5536860086d906b01ec5ed68cf50c7edcc40af", "lessThan": "266ffc92e68593759adfe3d58f188773d32782c3", "status": "affected", "versionType": "git"}, {"version": "3f5536860086d906b01ec5ed68cf50c7edcc40af", "lessThan": "c048b0a3c0836c4b1bef4b51d355d27090bf6790", "status": "affected", "versionType": "git"}, {"version": "3f5536860086d906b01ec5ed68cf50c7edcc40af", "lessThan": "c3f2feace5e4f4b01b68b9f947b19adb4155c32e", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/loongarch/kernel/rethook_trampoline.S"], "versions": [{"version": "6.3", "status": "affected"}, {"version": "0", "lessThan": "6.3", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.157", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.110", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.51", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.5", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3-rc2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.6.157"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.12.110"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.18.51"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "7.2.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "7.3-rc2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/a03b5e7483ad2c33ba5dd2adb8552e84bfee8fe2"}, {"url": "https://git.kernel.org/stable/c/8f15e95b438bc6b3c9f23a33c9a0d0678ebd1dc8"}, {"url": "https://git.kernel.org/stable/c/266ffc92e68593759adfe3d58f188773d32782c3"}, {"url": "https://git.kernel.org/stable/c/c048b0a3c0836c4b1bef4b51d355d27090bf6790"}, {"url": "https://git.kernel.org/stable/c/c3f2feace5e4f4b01b68b9f947b19adb4155c32e"}], "title": "LoongArch: Do not save/restore percpu base register in rethook trampoline", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["arch/loongarch/kernel/rethook_trampoline.S"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "a03b5e7483ad2c33ba5dd2adb8552e84bfee8fe2", "status": "affected", "version": "3f5536860086d906b01ec5ed68cf50c7edcc40af", "versionType": "git"}, {"lessThan": "8f15e95b438bc6b3c9f23a33c9a0d0678ebd1dc8", "status": "affected", "version": "3f5536860086d906b01ec5ed68cf50c7edcc40af", "versionType": "git"}, {"lessThan": "266ffc92e68593759adfe3d58f188773d32782c3", "status": "affected", "version": "3f5536860086d906b01ec5ed68cf50c7edcc40af", "versionType": "git"}, {"lessThan": "c048b0a3c0836c4b1bef4b51d355d27090bf6790", "status": "affected", "version": "3f5536860086d906b01ec5ed68cf50c7edcc40af", "versionType": "git"}, {"lessThan": "c3f2feace5e4f4b01b68b9f947b19adb4155c32e", "status": "affected", "version": "3f5536860086d906b01ec5ed68cf50c7edcc40af", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["arch/loongarch/kernel/rethook_trampoline.S"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.3"}, {"lessThan": "6.3", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.157", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.110", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.51", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3-rc2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: Do not save/restore percpu base register in rethook trampoline\n\nThe rethook trampoline saves $r21 ($u0), the percpu base, into its frame\nat entry and restores it at exit. Inbetween rethook_trampoline_handler()\nmay schedule via preempt_enable_notrace().\n\nIf the task migrates to another CPU, the frame's $r21 holds the old\nCPU's percpu base, and restoring it poisons $r21 on the new CPU. Until\nthe next user->kernel transition heals $r21, all this_cpu_*() accesses\n(runqueues, RCU per-CPU data, timer tick programming, FPU ownership)\nhit the wrong CPU's percpu area.\n\nUnder kretprobe-heavy preemptible load this can corrupt scheduler and\ntimer state: scheduling-while-atomic splats, wrong-CPU RCU warnings,\nWARN_ON_ONCE(rq != this_rq()) in nohz_balance_exit_idle(), and CPUs\nparking in the idle loop with the constant timer never re-armed (hard\nlockup). Reproduces on a Loongson-3A6000 with kretprobes on VFS paths\nplus heavy file churn (OS install / unsquashfs).\n\nBy convention $r21 always holds the current CPU's percpu base in kernel\nmode: SAVE_SOME() at exception entry reloads it only when coming from\nuser mode, and RESTORE_SOME() restores it only when returning to user\nmode; the context-switch path never writes it. Therefore the live $r21\nat trampoline exit is already correct, and nothing inbetween can change\nit legitimately (kernel C code cannot write a global register variable).\nThe same flaw existed even in the pre-rethook kretprobe trampoline since\nv6.3; it was carried over when rethook replaced it. Drop both the save\nand the restore here. Drop the restore is enough to solve the issue, and\ndrop the save is to keep the code tidy and no need to clear it."}], "id": "CVE-2026-89903", "lastModified": "2026-09-16T15:18:16.433", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-09-16T11:16:59.257", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/266ffc92e68593759adfe3d58f188773d32782c3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8f15e95b438bc6b3c9f23a33c9a0d0678ebd1dc8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a03b5e7483ad2c33ba5dd2adb8552e84bfee8fe2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c048b0a3c0836c4b1bef4b51d355d27090bf6790"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c3f2feace5e4f4b01b68b9f947b19adb4155c32e"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{}

{}