CVE-2024-38667: riscv: prevent pt_regs corruption for secondary idle threads

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-06-24 · updated 2026-06-17
Weakness: CWE-787

Description

In the Linux kernel, the following vulnerability has been resolved: riscv: prevent pt_regs corruption for secondary idle threads Top of the kernel thread stack should be reserved for pt_regs. However this is not the case for the idle threads of the secondary boot harts. Their stacks overlap with their pt_regs, so both may get corrupted. Similar issue has been fixed for the primary hart, see c7cdd96eca28 ("riscv: prevent stack corruption by reserving task_pt_regs(p) early"). However that fix was not propagated to the secondary harts. The problem has been noticed in some CPU hotplug tests with V enabled. The function smp_callin stored several registers on stack, corrupting top of pt_regs structure including status field. As a result, kernel attempted to save or restore inexistent V context.

Affected products

Linux kernel: from 5.7 before 6.1.93; from 6.2 before 6.6.33; from 6.7 before 6.9.4; 6.10-rc1 — fixed in 6.1.93, 6.6.33, 6.9.4

How to fix

Upgrade to a fixed version: Linux kernel 6.1.93, 6.6.33, 6.9.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-38667 or the next vulnerability affects your stack