CVE-2025-71102

// PoC for CVE-2025-71102 - Trigger kernel panic via incorrect SCS parameter // This PoC demonstrates the bug by enabling CONFIG_DEBUG_STACK_USAGE // and triggering shadow call stack checking on a crafted scenario #include <linux/kernel.h> #include <linux/sched.h> #include <linux/slab.h> /* Vulnerable code pattern (before fix): void scs_check_usage(struct task_struct *tsk) { unsigned long *s = task_scs(tsk); unsigned long *e = (unsigned long *)__scs_magic(tsk); // BUG: should be task_scs(tsk) while (s < e) { unsigned long val = *--e; if (val != (unsigned long)s) { // incorrect memory access printk(KERN_ALERT "SCS usage error\n"); } } } // Fixed code pattern: void scs_check_usage_fixed(struct task_struct *tsk) { unsigned long *s = task_scs(tsk); unsigned long *e = (unsigned long *)__scs_magic(task_scs(tsk)); // CORRECT while (s < e) { unsigned long val = *--e; if (val != (unsigned long)s) { printk(KERN_ALERT "SCS usage error\n"); } } } // To trigger: Enable CONFIG_DEBUG_STACK_USAGE in kernel config // The bug is automatically triggered when kernel performs SCS checking

{"cve": {"id": "CVE-2025-71102", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2026-01-14T15:15:59.210", "lastModified": "2026-03-25T18:56:00.797", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscs: fix a wrong parameter in __scs_magic\n\n__scs_magic() needs a 'void *' variable, but a 'struct task_struct *' is\ngiven. 'task_scs(tsk)' is the starting address of the task's shadow call\nstack, and '__scs_magic(task_scs(tsk))' is the end address of the task's\nshadow call stack. Here should be '__scs_magic(task_scs(tsk))'.\n\nThe user-visible effect of this bug is that when CONFIG_DEBUG_STACK_USAGE\nis enabled, the shadow call stack usage checking function\n(scs_check_usage) would scan an incorrect memory range. This could lead\n\n1. **Inaccurate stack usage reporting**: The function would calculate\n wrong usage statistics for the shadow call stack, potentially showing\n incorrect value in kmsg.\n\n2. **Potential kernel crash**: If the value of __scs_magic(tsk)is\n greater than that of __scs_magic(task_scs(tsk)), the for loop may\n access unmapped memory, potentially causing a kernel panic. However,\n this scenario is unlikely because task_struct is allocated via the slab\n allocator (which typically returns lower addresses), while the shadow\n call stack returned by task_scs(tsk) is allocated via vmalloc(which\n typically returns higher addresses).\n\nHowever, since this is purely a debugging feature\n(CONFIG_DEBUG_STACK_USAGE), normal production systems should be not\nunaffected. The bug only impacts developers and testers who are actively\ndebugging stack usage with this configuration enabled."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nscs: corrige un parámetro incorrecto en __scs_magic\n\n__scs_magic() necesita una variable 'void *', pero se le da una 'struct task_struct *'. 'task_scs(tsk)' es la dirección de inicio de la pila de llamadas en sombra de la tarea, y '__scs_magic(task_scs(tsk))' es la dirección final de la pila de llamadas en sombra de la tarea. Aquí debería ser '__scs_magic(task_scs(tsk))'.\n\nEl efecto visible para el usuario de este error es que cuando CONFIG_DEBUG_STACK_USAGE está habilitado, la función de comprobación de uso de la pila de llamadas en sombra (scs_check_usage) escanearía un rango de memoria incorrecto. Esto podría llevar a\n\n1. Informes de uso de pila inexactos: La función calcularía estadísticas de uso incorrectas para la pila de llamadas en sombra, potencialmente mostrando un valor incorrecto en kmsg.\n\n2. Posible caída del kernel: Si el valor de __scs_magic(tsk) es mayor que el de __scs_magic(task_scs(tsk)), el bucle for podría acceder a memoria no mapeada, potencialmente causando un pánico del kernel. Sin embargo, este escenario es poco probable porque task_struct se asigna a través del asignador slab (que típicamente devuelve direcciones más bajas), mientras que la pila de llamadas en sombra devuelta por task_scs(tsk) se asigna a través de vmalloc (que típicamente devuelve direcciones más altas).\n\nSin embargo, dado que esta es puramente una característica de depuración (CONFIG_DEBUG_STACK_USAGE), los sistemas de producción normales no deberían verse afectados. El error solo afecta a desarrolladores y probadores que están depurando activamente el uso de la pila con esta configuración habilitada."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8.1", "versionEndExcluding": "5.10.248", "matchCriteriaId": "F54AC764-1B64-490B-8453-1CB63C5FFCD1"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "5.15.198", "matchCriteriaId": "82159CAA-B6BA-43C6-85D8-65BDBC175A7E"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.1.160", "matchCriteriaId": "C10CC03E-16A9-428A-B449-40D3763E15F6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.6.120", "matchCriteriaId": "43 ... (truncated)