GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-22069 (GCVE-0-2025-22069)

Vulnerability from cvelistv5 – Published: 2025-04-16 14:12 – Updated: 2026-08-05 11:56
VLAI
Title
riscv: fgraph: Fix stack layout to match __arch_ftrace_regs argument of ftrace_return_to_handler
Summary
In the Linux kernel, the following vulnerability has been resolved: riscv: fgraph: Fix stack layout to match __arch_ftrace_regs argument of ftrace_return_to_handler Naresh Kamboju reported a "Bad frame pointer" kernel warning while running LTP trace ftrace_stress_test.sh in riscv. We can reproduce the same issue with the following command: ``` $ cd /sys/kernel/debug/tracing $ echo 'f:myprobe do_nanosleep%return args1=$retval' > dynamic_events $ echo 1 > events/fprobes/enable $ echo 1 > tracing_on $ sleep 1 ``` And we can get the following kernel warning: [ 127.692888] ------------[ cut here ]------------ [ 127.693755] Bad frame pointer: expected ff2000000065be50, received ba34c141e9594000 [ 127.693755] from func do_nanosleep return to ffffffff800ccb16 [ 127.698699] WARNING: CPU: 1 PID: 129 at kernel/trace/fgraph.c:755 ftrace_return_to_handler+0x1b2/0x1be [ 127.699894] Modules linked in: [ 127.700908] CPU: 1 UID: 0 PID: 129 Comm: sleep Not tainted 6.14.0-rc3-g0ab191c74642 #32 [ 127.701453] Hardware name: riscv-virtio,qemu (DT) [ 127.701859] epc : ftrace_return_to_handler+0x1b2/0x1be [ 127.702032] ra : ftrace_return_to_handler+0x1b2/0x1be [ 127.702151] epc : ffffffff8013b5e0 ra : ffffffff8013b5e0 sp : ff2000000065bd10 [ 127.702221] gp : ffffffff819c12f8 tp : ff60000080853100 t0 : 6e00000000000000 [ 127.702284] t1 : 0000000000000020 t2 : 6e7566206d6f7266 s0 : ff2000000065bd80 [ 127.702346] s1 : ff60000081262000 a0 : 000000000000007b a1 : ffffffff81894f20 [ 127.702408] a2 : 0000000000000010 a3 : fffffffffffffffe a4 : 0000000000000000 [ 127.702470] a5 : 0000000000000000 a6 : 0000000000000008 a7 : 0000000000000038 [ 127.702530] s2 : ba34c141e9594000 s3 : 0000000000000000 s4 : ff2000000065bdd0 [ 127.702591] s5 : 00007fff8adcf400 s6 : 000055556dc1d8c0 s7 : 0000000000000068 [ 127.702651] s8 : 00007fff8adf5d10 s9 : 000000000000006d s10: 0000000000000001 [ 127.702710] s11: 00005555737377c8 t3 : ffffffff819d899e t4 : ffffffff819d899e [ 127.702769] t5 : ffffffff819d89a0 t6 : ff2000000065bb18 [ 127.702826] status: 0000000200000120 badaddr: 0000000000000000 cause: 0000000000000003 [ 127.703292] [<ffffffff8013b5e0>] ftrace_return_to_handler+0x1b2/0x1be [ 127.703760] [<ffffffff80017bce>] return_to_handler+0x16/0x26 [ 127.704009] [<ffffffff80017bb8>] return_to_handler+0x0/0x26 [ 127.704057] [<ffffffff800d3352>] common_nsleep+0x42/0x54 [ 127.704117] [<ffffffff800d44a2>] __riscv_sys_clock_nanosleep+0xba/0x10a [ 127.704176] [<ffffffff80901c56>] do_trap_ecall_u+0x188/0x218 [ 127.704295] [<ffffffff8090cc3e>] handle_exception+0x14a/0x156 [ 127.705436] ---[ end trace 0000000000000000 ]--- The reason is that the stack layout for constructing argument for the ftrace_return_to_handler in the return_to_handler does not match the __arch_ftrace_regs structure of riscv, leading to unexpected results.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 33d4e904e24d14ff0fbc528b657ddc7c7b636e6a , < 7ed384db061a264bd806898f7ccab9b98b591488 (git)
Affected: a3ed4157b7d89800a0008de0c9e46a438a5c3745 , < 78b39c587b8f6c69140177108f9c08a75b1c7c37 (git)
Affected: a3ed4157b7d89800a0008de0c9e46a438a5c3745 , < 67a5ba8f742f247bc83e46dd2313c142b1383276 (git)
Affected: 6.12.75 , < 6.12.92 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.14
Unaffected: 0 , < 6.14 (semver)
Unaffected: 6.12.92 , ≤ 6.12.* (semver)
Unaffected: 6.14.2 , ≤ 6.14.* (semver)
Unaffected: 6.15 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/riscv/kernel/mcount.S"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7ed384db061a264bd806898f7ccab9b98b591488",
              "status": "affected",
              "version": "33d4e904e24d14ff0fbc528b657ddc7c7b636e6a",
              "versionType": "git"
            },
            {
              "lessThan": "78b39c587b8f6c69140177108f9c08a75b1c7c37",
              "status": "affected",
              "version": "a3ed4157b7d89800a0008de0c9e46a438a5c3745",
              "versionType": "git"
            },
            {
              "lessThan": "67a5ba8f742f247bc83e46dd2313c142b1383276",
              "status": "affected",
              "version": "a3ed4157b7d89800a0008de0c9e46a438a5c3745",
              "versionType": "git"
            },
            {
              "lessThan": "6.12.92",
              "status": "affected",
              "version": "6.12.75",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/riscv/kernel/mcount.S"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.92",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.92",
                  "versionStartIncluding": "6.12.75",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.2",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: fgraph: Fix stack layout to match __arch_ftrace_regs argument of ftrace_return_to_handler\n\nNaresh Kamboju reported a \"Bad frame pointer\" kernel warning while\nrunning LTP trace ftrace_stress_test.sh in riscv. We can reproduce the\nsame issue with the following command:\n\n```\n$ cd /sys/kernel/debug/tracing\n$ echo \u0027f:myprobe do_nanosleep%return args1=$retval\u0027 \u003e dynamic_events\n$ echo 1 \u003e events/fprobes/enable\n$ echo 1 \u003e tracing_on\n$ sleep 1\n```\n\nAnd we can get the following kernel warning:\n\n[  127.692888] ------------[ cut here ]------------\n[  127.693755] Bad frame pointer: expected ff2000000065be50, received ba34c141e9594000\n[  127.693755]   from func do_nanosleep return to ffffffff800ccb16\n[  127.698699] WARNING: CPU: 1 PID: 129 at kernel/trace/fgraph.c:755 ftrace_return_to_handler+0x1b2/0x1be\n[  127.699894] Modules linked in:\n[  127.700908] CPU: 1 UID: 0 PID: 129 Comm: sleep Not tainted 6.14.0-rc3-g0ab191c74642 #32\n[  127.701453] Hardware name: riscv-virtio,qemu (DT)\n[  127.701859] epc : ftrace_return_to_handler+0x1b2/0x1be\n[  127.702032]  ra : ftrace_return_to_handler+0x1b2/0x1be\n[  127.702151] epc : ffffffff8013b5e0 ra : ffffffff8013b5e0 sp : ff2000000065bd10\n[  127.702221]  gp : ffffffff819c12f8 tp : ff60000080853100 t0 : 6e00000000000000\n[  127.702284]  t1 : 0000000000000020 t2 : 6e7566206d6f7266 s0 : ff2000000065bd80\n[  127.702346]  s1 : ff60000081262000 a0 : 000000000000007b a1 : ffffffff81894f20\n[  127.702408]  a2 : 0000000000000010 a3 : fffffffffffffffe a4 : 0000000000000000\n[  127.702470]  a5 : 0000000000000000 a6 : 0000000000000008 a7 : 0000000000000038\n[  127.702530]  s2 : ba34c141e9594000 s3 : 0000000000000000 s4 : ff2000000065bdd0\n[  127.702591]  s5 : 00007fff8adcf400 s6 : 000055556dc1d8c0 s7 : 0000000000000068\n[  127.702651]  s8 : 00007fff8adf5d10 s9 : 000000000000006d s10: 0000000000000001\n[  127.702710]  s11: 00005555737377c8 t3 : ffffffff819d899e t4 : ffffffff819d899e\n[  127.702769]  t5 : ffffffff819d89a0 t6 : ff2000000065bb18\n[  127.702826] status: 0000000200000120 badaddr: 0000000000000000 cause: 0000000000000003\n[  127.703292] [\u003cffffffff8013b5e0\u003e] ftrace_return_to_handler+0x1b2/0x1be\n[  127.703760] [\u003cffffffff80017bce\u003e] return_to_handler+0x16/0x26\n[  127.704009] [\u003cffffffff80017bb8\u003e] return_to_handler+0x0/0x26\n[  127.704057] [\u003cffffffff800d3352\u003e] common_nsleep+0x42/0x54\n[  127.704117] [\u003cffffffff800d44a2\u003e] __riscv_sys_clock_nanosleep+0xba/0x10a\n[  127.704176] [\u003cffffffff80901c56\u003e] do_trap_ecall_u+0x188/0x218\n[  127.704295] [\u003cffffffff8090cc3e\u003e] handle_exception+0x14a/0x156\n[  127.705436] ---[ end trace 0000000000000000 ]---\n\nThe reason is that the stack layout for constructing argument for the\nftrace_return_to_handler in the return_to_handler does not match the\n__arch_ftrace_regs structure of riscv, leading to unexpected results."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable trampoline is armed only by writing to tracefs (`current_tracer`, `dynamic_events`, `events/*/enable`) and fires on ordinary syscall execution, both of which require local access to the machine. There is no network-facing consumer of `arch/riscv/kernel/mcount.S`.\nAC:L - The mismatch is a fixed compile-time stack layout error, not a race or a memory-layout gamble: the very first return of any traced function reads `s0` from `sp+24` instead of `sp+64` and writes `a0`/`a1` past the 80-byte frame, so the commit\u0027s four-command reproducer fails deterministically on the first `sleep 1`.\nPR:L - Reaching the trampoline requires only write access to tracefs, which is enforced by file permissions rather than any `capable()` check and is routinely delegated to an unprivileged tracing group via tracefs\u0027s `gid=` mount option (as Android and ChromeOS do for `atrace`). A non-root member of that group can arm `function_graph` or an fprobe and trigger the corruption.\nUI:N - The same local user both arms the tracer and triggers it by making any traced function return in their own process; no action by an administrator or other victim is needed.\nS:U - The out-of-bounds writes and reads all land in the kernel stack of the running task, within the kernel\u0027s own security authority \u2014 no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The C side treats `sp..sp+103` as `__arch_ftrace_regs` while only 80 bytes were allocated, so `a5`/`a6`/`a7` and the 64-byte `ftrace_partial_regs()` `memcpy` read 24 bytes past the frame into the caller\u0027s live stack, and `s0`/`t1`/`a0`\u2013`a4` are read from uninitialized stack \u2014 these stale kernel stack values (pointers, saved registers) are handed to fprobe/BPF callbacks as `$retval`/`$argN` and dumped into the trace buffer and the WARN register dump.\nI:H - `REG_S a0, 80(sp)` / `REG_S a1, 88(sp)` after `addi sp, sp, -80` is an unconditional 16-byte out-of-bounds stack write into the live frame of the traced function\u0027s caller, with `a0` holding an often user-influenceable return value; the same overhang lets a retfunc callback\u0027s writes to `args[5..7]` corrupt the caller\u0027s frame and even substitute the value `RESTORE_RET_ABI_STATE` reloads into `a0`, giving control over saved state and potentially return addresses further up the stack.\nA:H - With `HAVE_FUNCTION_GRAPH_FP_TEST` \u2014 effectively always enabled on riscv given `ARCH_WANT_FRAME_POINTERS` and `select FRAME_POINTER if PERF_EVENTS` \u2014 the garbage frame pointer makes `ftrace_pop_return_trace()` set `*ret = (unsigned long)panic`, so `return_to_handler`\u0027s `jalr a2` jumps directly into `panic()`, in addition to the WARN and `ftrace_graph_stop()` seen in the reported LTP failure."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:56:30.349Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7ed384db061a264bd806898f7ccab9b98b591488"
        },
        {
          "url": "https://git.kernel.org/stable/c/78b39c587b8f6c69140177108f9c08a75b1c7c37"
        },
        {
          "url": "https://git.kernel.org/stable/c/67a5ba8f742f247bc83e46dd2313c142b1383276"
        }
      ],
      "title": "riscv: fgraph: Fix stack layout to match __arch_ftrace_regs argument of ftrace_return_to_handler",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-22069",
    "datePublished": "2025-04-16T14:12:22.357Z",
    "dateReserved": "2024-12-29T08:45:45.814Z",
    "dateUpdated": "2026-08-05T11:56:30.349Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-22069",
      "date": "2026-09-16",
      "epss": "0.00212",
      "percentile": "0.11659"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-22069\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-04-16T15:16:01.100\",\"lastModified\":\"2026-07-30T06:22:10.323\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nriscv: fgraph: Fix stack layout to match __arch_ftrace_regs argument of ftrace_return_to_handler\\n\\nNaresh Kamboju reported a \\\"Bad frame pointer\\\" kernel warning while\\nrunning LTP trace ftrace_stress_test.sh in riscv. We can reproduce the\\nsame issue with the following command:\\n\\n```\\n$ cd /sys/kernel/debug/tracing\\n$ echo \u0027f:myprobe do_nanosleep%return args1=$retval\u0027 \u003e dynamic_events\\n$ echo 1 \u003e events/fprobes/enable\\n$ echo 1 \u003e tracing_on\\n$ sleep 1\\n```\\n\\nAnd we can get the following kernel warning:\\n\\n[  127.692888] ------------[ cut here ]------------\\n[  127.693755] Bad frame pointer: expected ff2000000065be50, received ba34c141e9594000\\n[  127.693755]   from func do_nanosleep return to ffffffff800ccb16\\n[  127.698699] WARNING: CPU: 1 PID: 129 at kernel/trace/fgraph.c:755 ftrace_return_to_handler+0x1b2/0x1be\\n[  127.699894] Modules linked in:\\n[  127.700908] CPU: 1 UID: 0 PID: 129 Comm: sleep Not tainted 6.14.0-rc3-g0ab191c74642 #32\\n[  127.701453] Hardware name: riscv-virtio,qemu (DT)\\n[  127.701859] epc : ftrace_return_to_handler+0x1b2/0x1be\\n[  127.702032]  ra : ftrace_return_to_handler+0x1b2/0x1be\\n[  127.702151] epc : ffffffff8013b5e0 ra : ffffffff8013b5e0 sp : ff2000000065bd10\\n[  127.702221]  gp : ffffffff819c12f8 tp : ff60000080853100 t0 : 6e00000000000000\\n[  127.702284]  t1 : 0000000000000020 t2 : 6e7566206d6f7266 s0 : ff2000000065bd80\\n[  127.702346]  s1 : ff60000081262000 a0 : 000000000000007b a1 : ffffffff81894f20\\n[  127.702408]  a2 : 0000000000000010 a3 : fffffffffffffffe a4 : 0000000000000000\\n[  127.702470]  a5 : 0000000000000000 a6 : 0000000000000008 a7 : 0000000000000038\\n[  127.702530]  s2 : ba34c141e9594000 s3 : 0000000000000000 s4 : ff2000000065bdd0\\n[  127.702591]  s5 : 00007fff8adcf400 s6 : 000055556dc1d8c0 s7 : 0000000000000068\\n[  127.702651]  s8 : 00007fff8adf5d10 s9 : 000000000000006d s10: 0000000000000001\\n[  127.702710]  s11: 00005555737377c8 t3 : ffffffff819d899e t4 : ffffffff819d899e\\n[  127.702769]  t5 : ffffffff819d89a0 t6 : ff2000000065bb18\\n[  127.702826] status: 0000000200000120 badaddr: 0000000000000000 cause: 0000000000000003\\n[  127.703292] [\u003cffffffff8013b5e0\u003e] ftrace_return_to_handler+0x1b2/0x1be\\n[  127.703760] [\u003cffffffff80017bce\u003e] return_to_handler+0x16/0x26\\n[  127.704009] [\u003cffffffff80017bb8\u003e] return_to_handler+0x0/0x26\\n[  127.704057] [\u003cffffffff800d3352\u003e] common_nsleep+0x42/0x54\\n[  127.704117] [\u003cffffffff800d44a2\u003e] __riscv_sys_clock_nanosleep+0xba/0x10a\\n[  127.704176] [\u003cffffffff80901c56\u003e] do_trap_ecall_u+0x188/0x218\\n[  127.704295] [\u003cffffffff8090cc3e\u003e] handle_exception+0x14a/0x156\\n[  127.705436] ---[ end trace 0000000000000000 ]---\\n\\nThe reason is that the stack layout for constructing argument for the\\nftrace_return_to_handler in the return_to_handler does not match the\\n__arch_ftrace_regs structure of riscv, leading to unexpected results.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: riscv: fgraph: Se corrige el dise\u00f1o de la pila para que coincida con el argumento __arch_ftrace_regs de ftrace_return_to_handler Naresh Kamboju inform\u00f3 una advertencia del kernel \\\"Puntero de marco incorrecto\\\" mientras ejecutaba el seguimiento LTP ftrace_stress_test.sh en riscv. Podemos reproducir el mismo problema con el siguiente comando: ``` $ cd /sys/kernel/debug/tracing $ echo \u0027f:myprobe do_nanosleep%return args1=$retval\u0027 \u0026gt; dynamic_events $ echo 1 \u0026gt; events/fprobes/enable $ echo 1 \u0026gt; tracing_on $ sleep 1 ``` Y podemos obtener la siguiente advertencia del kernel: [ 127.692888] ------------[ cortar aqu\u00ed ]------------ [ 127.693755] Puntero de marco incorrecto: se esperaba ff2000000065be50, se recibi\u00f3 ba34c141e9594000 [ 127.693755] de func do_nanosleep return a ffffffff800ccb16 [ 127.698699] ADVERTENCIA: CPU: 1 PID: 129 en kernel/trace/fgraph.c:755 ftrace_return_to_handler+0x1b2/0x1be [ 127.699894] M\u00f3dulos vinculados en: [ 127.700908] CPU: 1 UID: 0 PID: 129 Comm: sleep No contaminado 6.14.0-rc3-g0ab191c74642 #32 [ 127.701453] Nombre del hardware: riscv-virtio,qemu (DT) [ 127.701859] epc : ftrace_return_to_handler+0x1b2/0x1be [ 127.702032] ra : ftrace_return_to_handler+0x1b2/0x1be [ 127.702151] epc : ffffffff8013b5e0 ra : ffffffff8013b5e0 sp : ff2000000065bd10 [ 127.702221] gp : ffffffff819c12f8 tp : ff60000080853100 t0 : 6e00000000000000 [ 127.702284] t1 : 0000000000000020 t2 : 6e7566206d6f7266 s0 : ff2000000065bd80 [ 127.702346] s1 : ff60000081262000 a0 : 000000000000007b a1: ffffffff81894f20 [127.702408] a2: 0000000000000010 a3: fffffffffffffffffe a4: 00000000000000000 [127.702470] a5: 0000000000000000 a6: 0000000000000008 a7: 0000000000000038 [127.702530] s2: ba34c141e9594000 s3: 0000000000000000 s4: ff2000000065bdd0 [127.702591] s5: 00007fff8adcf400 s6: 000055556dc1d8c0 s7: 00000000000000068 [127.702651] s8: 00007fff8adf5d10 s9: 000000000000006d s10: 0000000000000001 [127.702710] s11: 00005555737377c8 t3: ffffffff819d899e t4: ffffffff819d899e [ 127.702769] t5: ffffffff819d89a0 t6: ff2000000065bb18 [127.702826] estado: 0000000200000120 direcci\u00f3n incorrecta: 0000000000000000 causa: 0000000000000003 [127.703292] [] ftrace_return_to_handler+0x1b2/0x1be [127.703760] [] return_to_handler+0x16/0x26 [127.704009] [] retorno_al_controlador+0x0/0x26 [ 127.704057] [] suspensi\u00f3n_com\u00fan+0x42/0x54 [ 127.704117] [] __riscv_sys_clock_nanosleep+0xba/0x10a [ 127.704176] [] hacer_trampa_ecall_u+0x188/0x218 [ 127.704295] [] controlar_excepci\u00f3n+0x14a/0x156 [ 127.705436] ---[ fin de seguimiento 0000000000000000 ]--- La raz\u00f3n es que el dise\u00f1o de la pila para construir el argumento para ftrace_return_to_handler en return_to_handler no coincide con la estructura __arch_ftrace_regs de riscv, lo que genera resultados inesperados.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"arch/riscv/kernel/mcount.S\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"33d4e904e24d14ff0fbc528b657ddc7c7b636e6a\",\"lessThan\":\"7ed384db061a264bd806898f7ccab9b98b591488\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a3ed4157b7d89800a0008de0c9e46a438a5c3745\",\"lessThan\":\"78b39c587b8f6c69140177108f9c08a75b1c7c37\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a3ed4157b7d89800a0008de0c9e46a438a5c3745\",\"lessThan\":\"67a5ba8f742f247bc83e46dd2313c142b1383276\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6.12.75\",\"lessThan\":\"6.12.92\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"arch/riscv/kernel/mcount.S\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.14\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.14\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.92\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.14.2\",\"lessThanOrEqual\":\"6.14.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-668\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.14\",\"versionEndExcluding\":\"6.14.2\",\"matchCriteriaId\":\"FADAE5D8-4808-442C-B218-77B2CE8780A0\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/67a5ba8f742f247bc83e46dd2313c142b1383276\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/78b39c587b8f6c69140177108f9c08a75b1c7c37\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7ed384db061a264bd806898f7ccab9b98b591488\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:29:51+00:00",
      "cve": "CVE-2025-22069",
      "id": "CVE-2025-22069",
      "initial_release_date": "2025-04-16T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: riscv: fgraph: Fix stack layout to match __arch_ftrace_regs argument of ftrace_return_to_handler",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-22069.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-31T00:22:26Z",
      "cve": "CVE-2025-22069",
      "id": "CVE-2025-22069",
      "initial_release_date": "2025-04-18T23:20:02Z",
      "product_status:known_not_affected": "459",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-22069",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-22069.json",
      "version": "9"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.