CVE-2026-89903 (GCVE-0-2026-89903)

Vulnerability from cvelistv5 – Published: 2026-09-16 10:32 – Updated: 2026-09-16 14:39
VLAI
Title
LoongArch: Do not save/restore percpu base register in rethook trampoline
Summary
In the Linux kernel, the following vulnerability has been resolved: LoongArch: Do not save/restore percpu base register in rethook trampoline The rethook trampoline saves $r21 ($u0), the percpu base, into its frame at entry and restores it at exit. Inbetween rethook_trampoline_handler() may schedule via preempt_enable_notrace(). If the task migrates to another CPU, the frame's $r21 holds the old CPU's percpu base, and restoring it poisons $r21 on the new CPU. Until the next user->kernel transition heals $r21, all this_cpu_*() accesses (runqueues, RCU per-CPU data, timer tick programming, FPU ownership) hit the wrong CPU's percpu area. Under kretprobe-heavy preemptible load this can corrupt scheduler and timer state: scheduling-while-atomic splats, wrong-CPU RCU warnings, WARN_ON_ONCE(rq != this_rq()) in nohz_balance_exit_idle(), and CPUs parking in the idle loop with the constant timer never re-armed (hard lockup). Reproduces on a Loongson-3A6000 with kretprobes on VFS paths plus heavy file churn (OS install / unsquashfs). By convention $r21 always holds the current CPU's percpu base in kernel mode: SAVE_SOME() at exception entry reloads it only when coming from user mode, and RESTORE_SOME() restores it only when returning to user mode; the context-switch path never writes it. Therefore the live $r21 at trampoline exit is already correct, and nothing inbetween can change it legitimately (kernel C code cannot write a global register variable). The same flaw existed even in the pre-rethook kretprobe trampoline since v6.3; it was carried over when rethook replaced it. Drop both the save and the restore here. Drop the restore is enough to solve the issue, and drop the save is to keep the code tidy and no need to clear it.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 3f5536860086d906b01ec5ed68cf50c7edcc40af , < a03b5e7483ad2c33ba5dd2adb8552e84bfee8fe2 (git)
Affected: 3f5536860086d906b01ec5ed68cf50c7edcc40af , < 8f15e95b438bc6b3c9f23a33c9a0d0678ebd1dc8 (git)
Affected: 3f5536860086d906b01ec5ed68cf50c7edcc40af , < 266ffc92e68593759adfe3d58f188773d32782c3 (git)
Affected: 3f5536860086d906b01ec5ed68cf50c7edcc40af , < c048b0a3c0836c4b1bef4b51d355d27090bf6790 (git)
Affected: 3f5536860086d906b01ec5ed68cf50c7edcc40af , < c3f2feace5e4f4b01b68b9f947b19adb4155c32e (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.3
Unaffected: 0 , < 6.3 (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.110 , ≤ 6.12.* (semver)
Unaffected: 6.18.51 , ≤ 6.18.* (semver)
Unaffected: 7.2.5 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/loongarch/kernel/rethook_trampoline.S"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a03b5e7483ad2c33ba5dd2adb8552e84bfee8fe2",
              "status": "affected",
              "version": "3f5536860086d906b01ec5ed68cf50c7edcc40af",
              "versionType": "git"
            },
            {
              "lessThan": "8f15e95b438bc6b3c9f23a33c9a0d0678ebd1dc8",
              "status": "affected",
              "version": "3f5536860086d906b01ec5ed68cf50c7edcc40af",
              "versionType": "git"
            },
            {
              "lessThan": "266ffc92e68593759adfe3d58f188773d32782c3",
              "status": "affected",
              "version": "3f5536860086d906b01ec5ed68cf50c7edcc40af",
              "versionType": "git"
            },
            {
              "lessThan": "c048b0a3c0836c4b1bef4b51d355d27090bf6790",
              "status": "affected",
              "version": "3f5536860086d906b01ec5ed68cf50c7edcc40af",
              "versionType": "git"
            },
            {
              "lessThan": "c3f2feace5e4f4b01b68b9f947b19adb4155c32e",
              "status": "affected",
              "version": "3f5536860086d906b01ec5ed68cf50c7edcc40af",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/loongarch/kernel/rethook_trampoline.S"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.51",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.5",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc2",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: Do not save/restore percpu base register in rethook trampoline\n\nThe rethook trampoline saves $r21 ($u0), the percpu base, into its frame\nat entry and restores it at exit. Inbetween rethook_trampoline_handler()\nmay schedule via preempt_enable_notrace().\n\nIf the task migrates to another CPU, the frame\u0027s $r21 holds the old\nCPU\u0027s percpu base, and restoring it poisons $r21 on the new CPU. Until\nthe next user-\u003ekernel transition heals $r21, all this_cpu_*() accesses\n(runqueues, RCU per-CPU data, timer tick programming, FPU ownership)\nhit the wrong CPU\u0027s percpu area.\n\nUnder kretprobe-heavy preemptible load this can corrupt scheduler and\ntimer state: scheduling-while-atomic splats, wrong-CPU RCU warnings,\nWARN_ON_ONCE(rq != this_rq()) in nohz_balance_exit_idle(), and CPUs\nparking in the idle loop with the constant timer never re-armed (hard\nlockup). Reproduces on a Loongson-3A6000 with kretprobes on VFS paths\nplus heavy file churn (OS install / unsquashfs).\n\nBy convention $r21 always holds the current CPU\u0027s percpu base in kernel\nmode: SAVE_SOME() at exception entry reloads it only when coming from\nuser mode, and RESTORE_SOME() restores it only when returning to user\nmode; the context-switch path never writes it. Therefore the live $r21\nat trampoline exit is already correct, and nothing inbetween can change\nit legitimately (kernel C code cannot write a global register variable).\nThe same flaw existed even in the pre-rethook kretprobe trampoline since\nv6.3; it was carried over when rethook replaced it. Drop both the save\nand the restore here. Drop the restore is enough to solve the issue, and\ndrop the save is to keep the code tidy and no need to clear it."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The rethook trampoline runs only after a locally installed kretprobe fires on a kernel function return (tracefs kprobe_events, perf kprobe PMU, or BPF kretprobe). It is not reached by receiving network packets or by a network-server protocol parser.\nAC:L - The attacker installs a kretprobe on a function they call (e.g. VFS) and forces the migration window: a helper thread can sched_setaffinity or generate preemption so preempt_enable_notrace() in rethook_trampoline_handler() reschedules onto another CPU before $r21 is restored.\nPR:L - Creating kretprobes via kprobe_events checks only LOCKDOWN_TRACEFS and DAC (0640), not capable(); tracing-group gid mounts on Android/ChromeOS/dev systems grant this to unprivileged users. CAP_BPF/CAP_PERFMON for BPF kretprobe attach are likewise Low because BPF tokens can delegate them.\nUI:N - The attacker installs and enables the kretprobe, then triggers matching returns and CPU migration from their own threads. No separate victim mount, click, or other interactive action is required.\nS:U - Restoring a stale percpu base corrupts this kernel\u0027s per-CPU areas (runqueues, RCU, timers, FPU owner) on the same host. That is in-kernel memory corruption, not a guest-to-host, IOMMU, or sandbox boundary crossing.\nC:H - Poisoned $r21 makes this_cpu_read() fetch another CPU\u0027s per-CPU data, including FPU ownership used to decide whether to save/restore vector state, so register contents can leak across tasks. Kernel memory corruption of this kind is a High confidentiality primitive.\nI:H - this_cpu_write() and related RMWs then modify the other CPU\u0027s scheduler, timer, and RCU per-CPU objects, including structures that hold function pointers (timer callbacks, sched class). That is kernel memory corruption enabling integrity loss and control-flow hijack.\nA:H - The same wrong-CPU accesses cause scheduling-while-atomic splats, wrong-CPU RCU warnings, rq != this_rq() WARNs, and idle CPUs whose constant timer is never re-armed, producing oops, panic, or hard lockup as documented in the fix."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T14:39:51.967Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a03b5e7483ad2c33ba5dd2adb8552e84bfee8fe2"
        },
        {
          "url": "https://git.kernel.org/stable/c/8f15e95b438bc6b3c9f23a33c9a0d0678ebd1dc8"
        },
        {
          "url": "https://git.kernel.org/stable/c/266ffc92e68593759adfe3d58f188773d32782c3"
        },
        {
          "url": "https://git.kernel.org/stable/c/c048b0a3c0836c4b1bef4b51d355d27090bf6790"
        },
        {
          "url": "https://git.kernel.org/stable/c/c3f2feace5e4f4b01b68b9f947b19adb4155c32e"
        }
      ],
      "title": "LoongArch: Do not save/restore percpu base register in rethook trampoline",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89903",
    "datePublished": "2026-09-16T10:32:03.038Z",
    "dateReserved": "2026-09-11T19:38:34.774Z",
    "dateUpdated": "2026-09-16T14:39:51.967Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89903",
      "date": "2026-09-25",
      "epss": "0.00175",
      "percentile": "0.06208"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "arch/loongarch/kernel/rethook_trampoline.S"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "a03b5e7483ad2c33ba5dd2adb8552e84bfee8fe2",
                    "status": "affected",
                    "version": "3f5536860086d906b01ec5ed68cf50c7edcc40af",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8f15e95b438bc6b3c9f23a33c9a0d0678ebd1dc8",
                    "status": "affected",
                    "version": "3f5536860086d906b01ec5ed68cf50c7edcc40af",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "266ffc92e68593759adfe3d58f188773d32782c3",
                    "status": "affected",
                    "version": "3f5536860086d906b01ec5ed68cf50c7edcc40af",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c048b0a3c0836c4b1bef4b51d355d27090bf6790",
                    "status": "affected",
                    "version": "3f5536860086d906b01ec5ed68cf50c7edcc40af",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c3f2feace5e4f4b01b68b9f947b19adb4155c32e",
                    "status": "affected",
                    "version": "3f5536860086d906b01ec5ed68cf50c7edcc40af",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "arch/loongarch/kernel/rethook_trampoline.S"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.3"
                  },
                  {
                    "lessThan": "6.3",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.157",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.110",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.51",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: Do not save/restore percpu base register in rethook trampoline\n\nThe rethook trampoline saves $r21 ($u0), the percpu base, into its frame\nat entry and restores it at exit. Inbetween rethook_trampoline_handler()\nmay schedule via preempt_enable_notrace().\n\nIf the task migrates to another CPU, the frame\u0027s $r21 holds the old\nCPU\u0027s percpu base, and restoring it poisons $r21 on the new CPU. Until\nthe next user-\u003ekernel transition heals $r21, all this_cpu_*() accesses\n(runqueues, RCU per-CPU data, timer tick programming, FPU ownership)\nhit the wrong CPU\u0027s percpu area.\n\nUnder kretprobe-heavy preemptible load this can corrupt scheduler and\ntimer state: scheduling-while-atomic splats, wrong-CPU RCU warnings,\nWARN_ON_ONCE(rq != this_rq()) in nohz_balance_exit_idle(), and CPUs\nparking in the idle loop with the constant timer never re-armed (hard\nlockup). Reproduces on a Loongson-3A6000 with kretprobes on VFS paths\nplus heavy file churn (OS install / unsquashfs).\n\nBy convention $r21 always holds the current CPU\u0027s percpu base in kernel\nmode: SAVE_SOME() at exception entry reloads it only when coming from\nuser mode, and RESTORE_SOME() restores it only when returning to user\nmode; the context-switch path never writes it. Therefore the live $r21\nat trampoline exit is already correct, and nothing inbetween can change\nit legitimately (kernel C code cannot write a global register variable).\nThe same flaw existed even in the pre-rethook kretprobe trampoline since\nv6.3; it was carried over when rethook replaced it. Drop both the save\nand the restore here. Drop the restore is enough to solve the issue, and\ndrop the save is to keep the code tidy and no need to clear it."
          }
        ],
        "id": "CVE-2026-89903",
        "lastModified": "2026-09-16T15:18:16.433",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-16T11:16:59.257",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/266ffc92e68593759adfe3d58f188773d32782c3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/8f15e95b438bc6b3c9f23a33c9a0d0678ebd1dc8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a03b5e7483ad2c33ba5dd2adb8552e84bfee8fe2"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c048b0a3c0836c4b1bef4b51d355d27090bf6790"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c3f2feace5e4f4b01b68b9f947b19adb4155c32e"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-19T01:43:14Z",
      "cve": "CVE-2026-89903",
      "id": "CVE-2026-89903",
      "initial_release_date": "2026-09-17T16:35:30Z",
      "product_status:known_not_affected": "347",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89903",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89903.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.