CVE-2025-40358

riscv: stacktrace: Disable KASAN checks for non-current tasks

State: Published
Severity: 7.1 High
Published: Dec 16, 2025
Updated: Aug 5, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

riscv: stacktrace: Disable KASAN checks for non-current tasks

Unwinding the stack of a task other than current, KASAN would report "BUG: KASAN: out-of-bounds in walk_stackframe+0x41c/0x460"

There is a same issue on x86 and has been resolved by the commit 84936118bdf3 ("x86/unwind: Disable KASAN checks for non-current tasks") The solution could be applied to RISC-V too.

This patch also can solve the issue: https://seclists.org/oss-sec/2025/q4/23

[pjw@kernel.org: clean up checkpatch issues]

Scores

CVSS	Score	Vector	Source
3.1	7.1 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	5d8544e2d0075a5f3c9a2cf27152354d54360da1 to before ef4d626ac59a56f8ec5cc09c1fef26f2923eec6fAffected 5d8544e2d0075a5f3c9a2cf27152354d54360da1 to before f34ba22989da61186f30a40b6a82e0b3337b96fcAffected 5d8544e2d0075a5f3c9a2cf27152354d54360da1 to before 27379fcc15a10d3e3780fe79ba3fc7ed1ccd78e2Affected 5d8544e2d0075a5f3c9a2cf27152354d54360da1 to before 2c8d2b53866fb229b438296526ef0fa5a990e5e5Affected 5d8544e2d0075a5f3c9a2cf27152354d54360da1 to before 060ea84a484e852b52b938f234bf9b5503a6c910Affected
LinuxLinux	4.15Affected before 4.15Not affected 6.1.167 through 6.1.Not affected 6.6.117 through 6.6.Not affected 6.12.58 through 6.12.Not affected 6.17.8 through 6.17.Not affected 6.18 and laterNot affected

Product

Versions

LinuxLinux

5d8544e2d0075a5f3c9a2cf27152354d54360da1 to before ef4d626ac59a56f8ec5cc09c1fef26f2923eec6fAffected
5d8544e2d0075a5f3c9a2cf27152354d54360da1 to before f34ba22989da61186f30a40b6a82e0b3337b96fcAffected
5d8544e2d0075a5f3c9a2cf27152354d54360da1 to before 27379fcc15a10d3e3780fe79ba3fc7ed1ccd78e2Affected
5d8544e2d0075a5f3c9a2cf27152354d54360da1 to before 2c8d2b53866fb229b438296526ef0fa5a990e5e5Affected
5d8544e2d0075a5f3c9a2cf27152354d54360da1 to before 060ea84a484e852b52b938f234bf9b5503a6c910Affected

LinuxLinux

4.15Affected
before 4.15Not affected
6.1.167 through 6.1.*Not affected
6.6.117 through 6.6.*Not affected
6.12.58 through 6.12.*Not affected
6.17.8 through 6.17.*Not affected
6.18 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.