In the Linux kernel, a trace configuration that includes the __sbi_ecall function can trigger an infinite loop of trace snapshots. Each snapshot raises an IPI that re‑enters __sbi_ecall, causing a recursive deadlock that freezes the kernel. The flaw stems from a scheduling deadlock vulnerability (CWE‑667) and results in a denial of service that can halt all system activity for the affected RISC‑V CPUs.

All RISC‑V builds of the Linux kernel that compile for sbi_ecall.c trace, specifically kernel versions 6.11 and 6.19/RC1–RC4, are affected. The problem also exists in any future releases that have not yet incorporated the fix to exclude sbi_ecall functions from function tracing. Linux kernel vendors such as the Linux Foundation maintain these releases and provide the necessary patch.

The CVSS v3 score of 5.5 indicates moderate severity. EPSS is less than 1 percent, suggesting low likelihood of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. Attackers would need local privilege or the ability to write to /sys/kernel/tracing/set_ftrace_filter to inject the "__sbi_ecall" trace filter. The deadlock is triggered by a single initial __sbi_ecall, making the exploit straightforward once the trace filter is configured; systems that enable timer‑based sbi ecalls without the SSTC extension are particularly easy to target.