CVE-2026-64235
8.1Linux · Kernel
A kernel panic vulnerability in the Linux x86 ftrace subsystem occurs when CONFIG_CALL_DEPTH_TRACKING is enabled on retbleed-affected platforms.
Executive summary
A kernel crash vulnerability in the Linux kernel x86 ftrace subsystem affects systems with specific retbleed mitigations enabled, leading to potential denial of service.
Vulnerability
This is an improper handling of relocation references in dynamic trampolines within the x86 ftrace subsystem, requiring no user interaction or privileges.
Business impact
A successful exploit or trigger of this flaw results in a kernel page fault and subsequent system crash, causing unexpected reboots and potential service downtime. The CVSS score of 8.1 reflects the high severity of potential denial of service against critical infrastructure hosting affected kernel versions.
Remediation
Immediate Action: Update the Linux kernel to version 6.12.93, 6.18.35, 7.0.12, or later where the relocation issue is resolved.
Proactive Monitoring: Monitor system logs for kernel BUG messages, page faults, and unexpected reboots associated with ftrace or dynamic trampolines.
Compensating Controls: Disable CONFIG_CALL_DEPTH_TRACKING or adjust retbleed mitigation parameters if immediate kernel updates are not feasible in the environment.
Exploitation status
Public Exploit Available: false
Analyst recommendation
Administrators managing affected Linux environments should apply the latest kernel patches promptly to maintain system stability. Prioritize updating systems utilizing CONFIG_CALL_DEPTH_TRACKING on retbleed-affected hardware platforms to prevent unexpected kernel crashes.