CVE-2026-64235 Overview
CVE-2026-64235 is a Linux kernel vulnerability in the x86/ftrace subsystem. The flaw affects dynamic ftrace trampolines on x86 platforms when CONFIG_CALL_DEPTH_TRACKING is enabled with retbleed=stuff mitigation on retbleed-affected CPUs such as Skylake. Registering a dynamic ftrace trampoline triggers a kernel page fault on the first call into the traced function, leading to a kernel panic.
The root cause is an unadjusted %rip-relative displacement in the copied CALL_DEPTH_ACCOUNT instruction. The trampoline references an incorrect address for the per-CPU __x86_call_depth value, causing a supervisor write to non-present memory.
Critical Impact
A local user enabling a kprobe or tracer on a vulnerable kernel triggers a fatal page fault, resulting in denial of service through kernel panic.
Affected Products
- Linux kernel builds on x86_64 with CONFIG_CALL_DEPTH_TRACKING enabled
- Systems booted with retbleed=stuff on retbleed-affected CPUs (for example, Intel Skylake)
- Kernel versions incorporating commit 59bec00ace28 ("x86/percpu: Introduce %rip-relative addressing to PER_CPU_VAR()") prior to the fix
Discovery Timeline
- 2026-07-24 - CVE-2026-64235 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-64235
Vulnerability Analysis
The vulnerability resides in the dynamic ftrace trampoline construction on x86_64. When ftrace generates a dynamic trampoline for a traced function, it copies instruction sequences from ftrace_caller and ftrace_regs_caller in ftrace_64.S. One of these copied instructions is the CALL_DEPTH_ACCOUNT sequence, which increments the per-CPU call depth counter used by the retbleed mitigation.
The critical instruction is sarq $5, %gs:__x86_call_depth(%rip). This instruction uses %rip-relative addressing to locate the __x86_call_depth per-CPU variable. Because the trampoline is allocated at a runtime-determined memory location, the encoded displacement from the source instruction no longer resolves to the correct target address after the copy.
On first execution of the trampoline, the CPU computes an invalid effective address and attempts a supervisor write to non-present memory. The kernel raises a page fault it cannot handle, producing an oops and a fatal panic.
Root Cause
The regression was introduced by commit 59bec00ace28, which converted PER_CPU_VAR() references to %rip-relative addressing. The ftrace trampoline allocator copies the affected instructions verbatim without applying a relocation fixup, so the displacement encoded in the copy points to an arbitrary and invalid address.
Attack Vector
Exploitation requires local privileges sufficient to enable tracing, such as writing to /sys/kernel/tracing/kprobe_events. A minimal reproducer creates a kprobe on __x64_sys_clock_nanosleep, enables the event, and invokes the syscall. The resulting page fault crashes the kernel, denying service to all users. The vulnerability does not provide code execution or information disclosure, but reliably panics affected systems.
The vulnerability manifests in the dynamic trampoline generation path. See the referenced kernel commits for the exact patch mechanics.
Detection Methods for CVE-2026-64235
Indicators of Compromise
- Kernel oops messages referencing unable to handle page fault for address in dmesg with call stacks involving call_depth_return_thunk or ftrace trampoline addresses
- Unexpected kernel panics immediately after enabling kprobes, tracepoints, or function tracers on affected kernels
- Crash traces citing __x86_call_depth or CALL_DEPTH_ACCOUNT context on x86_64 hosts booted with retbleed=stuff
Detection Strategies
- Enumerate hosts running x86_64 kernels built with CONFIG_CALL_DEPTH_TRACKING=y and inspect /proc/cmdline for retbleed=stuff
- Compare running kernel versions against the fixed commits 8093442a2d1d, 9edff632ca21, a17dc12bfed8, and d59cc66b7027 from the stable trees
- Monitor kernel crash reporting pipelines (kdump, systemd-coredump, abrt) for fault signatures involving ftrace trampolines
Monitoring Recommendations
- Ingest /var/log/kern.log and journalctl -k output into a centralized log platform and alert on Kernel panic - not syncing events
- Audit access to /sys/kernel/tracing/ and /sys/kernel/debug/tracing/ to identify unexpected users creating kprobe events
- Track host uptime regressions and unscheduled reboots across x86 Skylake-class fleets
How to Mitigate CVE-2026-64235
Immediate Actions Required
- Apply the upstream Linux kernel fix that invokes text_poke_apply_relocation() on the copied CALL_DEPTH_ACCOUNT slots in ftrace_caller and ftrace_regs_caller
- Restrict access to tracing interfaces under /sys/kernel/tracing/ and /sys/kernel/debug/tracing/ to root and trusted administrators
- Audit deployed distribution kernels for backports of the fix commits before enabling function tracing in production
Patch Information
The fix relocates the %rip-relative displacement in the copied CALL_DEPTH_ACCOUNT instruction using text_poke_apply_relocation(), mirroring the approach used by the x86 BPF JIT in x86_call_depth_emit_accounting(). Both CALL_DEPTH_ACCOUNT slots in ftrace_caller and ftrace_regs_caller are corrected. Reference the following stable tree commits: Linux Kernel Commit 8093442, Linux Kernel Commit 9edff63, Linux Kernel Commit a17dc12, and Linux Kernel Commit d59cc66.
Workarounds
- Boot affected hosts without retbleed=stuff, selecting an alternative retbleed mitigation acceptable to your threat model
- Rebuild the kernel with CONFIG_CALL_DEPTH_TRACKING disabled where the retbleed mitigation is not required
- Prevent creation of dynamic ftrace trampolines by restricting kprobe, uprobe, and function tracer usage on production hosts
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
