The vulnerability arises in the Linux kernel's handling of the shadow call stack on RISC‑V processors. When CONFIG_SHADOW_CALL_STACK is enabled, the entry routine reloads the kernel shadow call stack pointer (gp) only if the trap originates from userspace. The decision is based on a comparison of the trap‑time tp register with the current tp. Because tp is a user‑writable register, an attacker can overwrite tp with the linear‑map address of its own task_struct before a trap occurs. This causes the comparison to succeed, the kernel skips the reload, and continues execution with a gp that points to an attacker‑controlled address. The compiler‑emitted stack operations in every non‑leaf function then read and write through that address, yielding an arbitrary write primitive and allowing control‑flow hijack within the kernel. The poisoned gp is stored in the task_struct on return, so the flaw persists across subsequent entries, providing a persistent exploitation path. Based on the description, the attack vector is a local user process that manipulates the tp register before triggering a trap.

Affected systems include Linux kernels running on RISC‑V hardware with CONFIG_SHADOW_CALL_STACK enabled. The issue exists in any kernel version that contains the vulnerable entry code before the patch that replaces the tp comparison with the hardware‑controlled sstatus.SPP bit. No specific version numbers are provided in the data, so all kernels containing the offending code are considered vulnerable.

The CVSS score is 7.8, reflecting a high severity but the EPSS score is below 1 %, indicating that active exploitation is currently uncommon. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires local user privileges and the ability to privilege‑write the tp register, so the attack path is limited to local processes. The patch enforces the use of the unforgeable sstatus.SPP bit, removing the control‑related flaw. Based on the description, it is inferred that the exploit leverages a carefully crafted userspace process that triggers a trap after setting tp, hence local user escalation.