PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-64235 Linux CVE debrief

A HIGH severity vulnerability was found in the Linux kernel, specifically in the x86/ftrace component. The vulnerability is related to the handling of dynamic trampolines and call depth tracking. When CONFIG_CALL_DEPTH_TRACKING is enabled on an x86 retbleed-affected platform, registering a dynamic ftrace trampoline can cause a crash on the first call into the traced function. The crash occurs due to a page fault caused by incorrect addressing of the per-cpu __x86_call_depth value.

Vendor
Linux
Product
Unknown
CVSS
HIGH 8.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-24
Original CVE updated
2026-08-12
Advisory published
2026-07-24
Advisory updated
2026-08-12

Who should care

System administrators and security teams responsible for Linux kernel-based systems, especially those with CONFIG_CALL_DEPTH_TRACKING enabled on x86 retbleed-affected platforms, should be aware of this vulnerability. This vulnerability can potentially lead to a system crash or denial of service.

Technical summary

The vulnerability is caused by the incorrect handling of %rip-relative percpu references in dynamic trampolines. The introduction of %rip-relative addressing to PER_CPU_VAR() changed the way the call depth accounting addressing works, making it relative to $rip instead of an absolute address. This change causes the displacement to be adjusted at runtime, leading to a page fault when the targeted address is wrong. The fix involves adjusting the %rip-relative displacement of the copied CALL_DEPTH_ACCOUNT instruction by calling text_poke_apply_relocation().

Defensive priority

High priority should be given to patching this vulnerability, especially for systems with CONFIG_CALL_DEPTH_TRACKING enabled on x86 retbleed-affected platforms.

Recommended defensive actions

  • Apply the official patch to fix the vulnerability
  • Ensure CONFIG_CALL_DEPTH_TRACKING is properly configured
  • Monitor system logs for potential crashes or errors related to ftrace and call depth tracking
  • Consider implementing compensating controls to mitigate potential impacts
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability was introduced by the commit 59bec00ace28 (x86/percpu: Introduce %rip-relative addressing to PER_CPU_VAR()). The fix involves backporting the adjustment of %rip-relative displacement of the copied CALL_DEPTH_ACCOUNT instruction.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-64235 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-64235

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-64235 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-64235

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/8093442a2d1d4b42b9340a86023ccb2afb30b93a

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/9edff632ca216169846f8a63a5a3dc467e239c7a

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/a17dc12bfed8868e6a86f3b45c16065a70641acb

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/d59cc66b702757e3c5a711e78a38583eac0c2738

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.