Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2025-71102

scs: fix a wrong parameter in __scs_magic

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: scs: fix a wrong parameter in __scs_magic __scs_magic() needs a 'void *' variable, but a 'struct task_struct *' is given. 'task_scs(tsk)' is the starting address of the task's shadow call stack, and '__scs_magic(task_scs(tsk))' is the end address of the task's shadow call stack. Here should be '__scs_magic(task_scs(tsk))'. The user-visible effect of this bug is that when CONFIG_DEBUG_STACK_USAGE is enabled, the shadow call stack usage checking function (scs_check_usage) would scan an incorrect memory range. This could lead 1. **Inaccurate stack usage reporting**: The function would calculate wrong usage statistics for the shadow call stack, potentially showing incorrect value in kmsg. 2. **Potential kernel crash**: If the value of __scs_magic(tsk)is greater than that of __scs_magic(task_scs(tsk)), the for loop may access unmapped memory, potentially causing a kernel panic. However, this scenario is unlikely because task_struct is allocated via the slab allocator (which typically returns lower addresses), while the shadow call stack returned by task_scs(tsk) is allocated via vmalloc(which typically returns higher addresses). However, since this is purely a debugging feature (CONFIG_DEBUG_STACK_USAGE), normal production systems should be not unaffected. The bug only impacts developers and testers who are actively debugging stack usage with this configuration enabled.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 5bbaf9d1fcb9be696ee9a61636ab6803556c70f2 to < 1727e8bd69103a68963a5613a0ddb6d8d37df5d3affected
  • 5bbaf9d1fcb9be696ee9a61636ab6803556c70f2 to < cfdf6250b63b953b1d8e60814c8ca96c6f9d1c8caffected
  • 5bbaf9d1fcb9be696ee9a61636ab6803556c70f2 to < 57ba40b001be27786d0570dd292289df748b306baffected
  • 5bbaf9d1fcb9be696ee9a61636ab6803556c70f2 to < 062774439d442882b44f5eab8c256ad3423ef284affected
  • 5bbaf9d1fcb9be696ee9a61636ab6803556c70f2 to < 9ef28943471a16e4f9646bc3e8e2de148e7d8d7baffected
  • 5bbaf9d1fcb9be696ee9a61636ab6803556c70f2 to < a19fb3611e4c06624fc0f83ef19f4fb8d57d4751affected
  • 5bbaf9d1fcb9be696ee9a61636ab6803556c70f2 to < 08bd4c46d5e63b78e77f2605283874bbe868ab19affected

Linux Linux

Default version status: affected

  • 5.8affected
  • 0 to < 5.8unaffected
  • 5.10.248 to ≤ 5.10.*unaffected
  • 5.15.198 to ≤ 5.15.*unaffected
  • 6.1.160 to ≤ 6.1.*unaffected
  • 6.6.120 to ≤ 6.6.*unaffected
  • 6.12.64 to ≤ 6.12.*unaffected
  • 6.18.3 to ≤ 6.18.*unaffected
  • 6.19 to ≤ *unaffected

References