This issue arises when a kretprobe attempts to read the kernel stack on a RISC‑V system. The rethook trampoline does not preserve the original stack pointer, so regs->sp contains an arbitrary value. A subsequent stack access causes a fault, leading to a kernel panic. The vulnerability results in a denial‑of‑service condition that can affect any process running on the affected system.

All Linux kernels that execute the RISC‑V rethook trampoline before the fix, including any RISC‑V target running a kernel that implements dynamic kretprobes. The patch applies to the mainline Linux kernel repository; older kernels lacking the commit are vulnerable.

The vulnerability requires the ability to enable a kretprobe that reads the stack, such as writing to /sys/kernel/tracing/dynamic_events. An attacker with kernel‑level privileges, or one that can configure tracing, could trigger the crash. The EPSS score is < 1% and the CVSS score is 5.5, indicating a moderate risk. The flaw can cause a full kernel panic, making it a denial‑of‑service condition. It is not listed in CISA KEV. The attack vector is likely local or remote with sufficient privilege to control kprobe configuration.