CVE-2026-64235

A flaw was found in the Linux kernel. A local user with the ability to enable dynamic tracing on an x86 retbleed-affected platform with CONFIG_CALL_DEPTH_TRACKING enabled could trigger a kernel panic. This occurs due to incorrect relocation of %rip-relative percpu references in dynamic ftrace trampolines, leading to an invalid memory write. Successful exploitation results in a denial of service.

A dynamic ftrace trampoline can contain RIP relative percpu references copied from the original ftrace caller code. If the displacement is not relocated for the new trampoline address, the call_depth accounting instruction can write to the wrong kernel address and trigger a supervisor page fault and kernel panic. The practical trigger requires a specific affected x86 configuration with CONFIG_CALL_DEPTH_TRACKING and retbleed stuffing enabled, plus the ability to register or enable dynamic tracing such as kprobe based tracing. For the CVSS the PR:L is used for the paranoid score because a local user with delegated tracing or reduced administration rights may be able to reach the interface, while typical systems require administrator level tracing access. The issue is not network reachable. Impact is at least local denial of service, and in the worst still defensible interpretation may include limited confidentiality or integrity impact due to an invalid kernel memory write candidate.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.