{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.100-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.1.5-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  riscv: probes: save original sp in rethook trampoline  Reading a word from the stack in a kretprobe crashes a risc-v kernel.  $ cd /sys/kernel/tracing/ $ echo 'r n_tty_write $stack0' \u003e dynamic_events $ echo 1 \u003e events/kprobes/enable Unable to handle kernel paging request at virtual address 0000000200000128 ... [\u003cffffffff80016d16\u003e] regs_get_kernel_stack_nth+0x26/0x38 [\u003cffffffff80177196\u003e] process_fetch_insn+0x3ee/0x760 [\u003cffffffff80177836\u003e] kretprobe_trace_func+0x116/0x1f0 [\u003cffffffff8017795a\u003e] kretprobe_dispatcher+0x4a/0x58 [\u003cffffffff8013572e\u003e] kretprobe_rethook_handler+0x5e/0x90 [\u003cffffffff80180838\u003e] rethook_trampoline_handler+0x70/0x108 [\u003cffffffff8001ba32\u003e] arch_rethook_trampoline_callback+0x12/0x1c [\u003cffffffff8001ba84\u003e] arch_rethook_trampoline+0x48/0x94 [\u003cffffffff8067872a\u003e] tty_write+0x1a/0x30  In regs_get_kernel_stack_nth, regs-\u003esp contains an arbitrary value.  arch_rethook_trampoline saves the registers from the probed function in a struct pt_regs. sp is not saved. Instead, sp is decremented for arch_rethook_trampoline's local stack.  Fix this crash and save the original sp along with the other registers. Use a0 as a temporary register, it is overwritten anyway.  [pjw@kernel.org: added Fixes tag; cc'ed stable]",
  "id": "DEBIAN-CVE-2026-72028",
  "modified": "2026-08-17T08:47:39.210189618Z",
  "published": "2026-08-15T06:21:01.953Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-72028"
    }
  ],
  "upstream": [
    "CVE-2026-72028"
  ]
}