CVE-2026-64235 Linux CVE debrief

Who should care

System administrators and security teams responsible for Linux kernel-based systems, especially those with CONFIG_CALL_DEPTH_TRACKING enabled on x86 retbleed-affected platforms, should be aware of this vulnerability. This vulnerability can potentially lead to a system crash or denial of service.

Technical summary

The vulnerability is caused by the incorrect handling of %rip-relative percpu references in dynamic trampolines. The introduction of %rip-relative addressing to PER_CPU_VAR() changed the way the call depth accounting addressing works, making it relative to $rip instead of an absolute address. This change causes the displacement to be adjusted at runtime, leading to a page fault when the targeted address is wrong. The fix involves adjusting the %rip-relative displacement of the copied CALL_DEPTH_ACCOUNT instruction by calling text_poke_apply_relocation().

Defensive priority

High priority should be given to patching this vulnerability, especially for systems with CONFIG_CALL_DEPTH_TRACKING enabled on x86 retbleed-affected platforms.

Recommended defensive actions

• Apply the official patch to fix the vulnerability
• Ensure CONFIG_CALL_DEPTH_TRACKING is properly configured
• Monitor system logs for potential crashes or errors related to ftrace and call depth tracking
• Consider implementing compensating controls to mitigate potential impacts
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability was introduced by the commit 59bec00ace28 (x86/percpu: Introduce %rip-relative addressing to PER_CPU_VAR()). The fix involves backporting the adjustment of %rip-relative displacement of the copied CALL_DEPTH_ACCOUNT instruction.

Official resources