CVE-2026-72028

A flaw was found in the Linux kernel's kretprobe (kernel return probe) functionality on RISC-V architectures. A local attacker can trigger a kernel crash by attempting to read from the stack within a kretprobe. This occurs because the arch_rethook_trampoline does not correctly save the original stack pointer, leading to an arbitrary value being used when reading from the stack. Successful exploitation results in a Denial of Service (DoS) due to the kernel crashing.

This vulnerability is rated as having a Moderate impact because configuring return probe tracing requires elevated local privileges and the potential failure is restricted to a system-level denial of service. Furthermore, this issue specifically affects the RISC-V processor architecture, which is not supported in Red Hat Enterprise Linux. As a result, standard Red Hat kernel packages do not include the vulnerable architecture code and are not impacted.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.