CVE-2025-71102 (GCVE-0-2025-71102)

Vulnerability from cvelistv5 – Published: 2026-01-14 15:05 – Updated: 2026-05-11 21:54
VLAI
Title
scs: fix a wrong parameter in __scs_magic
Summary
In the Linux kernel, the following vulnerability has been resolved: scs: fix a wrong parameter in __scs_magic __scs_magic() needs a 'void *' variable, but a 'struct task_struct *' is given. 'task_scs(tsk)' is the starting address of the task's shadow call stack, and '__scs_magic(task_scs(tsk))' is the end address of the task's shadow call stack. Here should be '__scs_magic(task_scs(tsk))'. The user-visible effect of this bug is that when CONFIG_DEBUG_STACK_USAGE is enabled, the shadow call stack usage checking function (scs_check_usage) would scan an incorrect memory range. This could lead 1. **Inaccurate stack usage reporting**: The function would calculate wrong usage statistics for the shadow call stack, potentially showing incorrect value in kmsg. 2. **Potential kernel crash**: If the value of __scs_magic(tsk)is greater than that of __scs_magic(task_scs(tsk)), the for loop may access unmapped memory, potentially causing a kernel panic. However, this scenario is unlikely because task_struct is allocated via the slab allocator (which typically returns lower addresses), while the shadow call stack returned by task_scs(tsk) is allocated via vmalloc(which typically returns higher addresses). However, since this is purely a debugging feature (CONFIG_DEBUG_STACK_USAGE), normal production systems should be not unaffected. The bug only impacts developers and testers who are actively debugging stack usage with this configuration enabled.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 5bbaf9d1fcb9be696ee9a61636ab6803556c70f2 , < 1727e8bd69103a68963a5613a0ddb6d8d37df5d3 (git)
Affected: 5bbaf9d1fcb9be696ee9a61636ab6803556c70f2 , < cfdf6250b63b953b1d8e60814c8ca96c6f9d1c8c (git)
Affected: 5bbaf9d1fcb9be696ee9a61636ab6803556c70f2 , < 57ba40b001be27786d0570dd292289df748b306b (git)
Affected: 5bbaf9d1fcb9be696ee9a61636ab6803556c70f2 , < 062774439d442882b44f5eab8c256ad3423ef284 (git)
Affected: 5bbaf9d1fcb9be696ee9a61636ab6803556c70f2 , < 9ef28943471a16e4f9646bc3e8e2de148e7d8d7b (git)
Affected: 5bbaf9d1fcb9be696ee9a61636ab6803556c70f2 , < a19fb3611e4c06624fc0f83ef19f4fb8d57d4751 (git)
Affected: 5bbaf9d1fcb9be696ee9a61636ab6803556c70f2 , < 08bd4c46d5e63b78e77f2605283874bbe868ab19 (git)
Create a notification for this product.
Linux Linux Affected: 5.8
Unaffected: 0 , < 5.8 (semver)
Unaffected: 5.10.248 , ≤ 5.10.* (semver)
Unaffected: 5.15.198 , ≤ 5.15.* (semver)
Unaffected: 6.1.160 , ≤ 6.1.* (semver)
Unaffected: 6.6.120 , ≤ 6.6.* (semver)
Unaffected: 6.12.64 , ≤ 6.12.* (semver)
Unaffected: 6.18.3 , ≤ 6.18.* (semver)
Unaffected: 6.19 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/scs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1727e8bd69103a68963a5613a0ddb6d8d37df5d3",
              "status": "affected",
              "version": "5bbaf9d1fcb9be696ee9a61636ab6803556c70f2",
              "versionType": "git"
            },
            {
              "lessThan": "cfdf6250b63b953b1d8e60814c8ca96c6f9d1c8c",
              "status": "affected",
              "version": "5bbaf9d1fcb9be696ee9a61636ab6803556c70f2",
              "versionType": "git"
            },
            {
              "lessThan": "57ba40b001be27786d0570dd292289df748b306b",
              "status": "affected",
              "version": "5bbaf9d1fcb9be696ee9a61636ab6803556c70f2",
              "versionType": "git"
            },
            {
              "lessThan": "062774439d442882b44f5eab8c256ad3423ef284",
              "status": "affected",
              "version": "5bbaf9d1fcb9be696ee9a61636ab6803556c70f2",
              "versionType": "git"
            },
            {
              "lessThan": "9ef28943471a16e4f9646bc3e8e2de148e7d8d7b",
              "status": "affected",
              "version": "5bbaf9d1fcb9be696ee9a61636ab6803556c70f2",
              "versionType": "git"
            },
            {
              "lessThan": "a19fb3611e4c06624fc0f83ef19f4fb8d57d4751",
              "status": "affected",
              "version": "5bbaf9d1fcb9be696ee9a61636ab6803556c70f2",
              "versionType": "git"
            },
            {
              "lessThan": "08bd4c46d5e63b78e77f2605283874bbe868ab19",
              "status": "affected",
              "version": "5bbaf9d1fcb9be696ee9a61636ab6803556c70f2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/scs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.8"
            },
            {
              "lessThan": "5.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.248",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.198",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.120",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.64",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.248",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.198",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.160",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.120",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.64",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.3",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscs: fix a wrong parameter in __scs_magic\n\n__scs_magic() needs a \u0027void *\u0027 variable, but a \u0027struct task_struct *\u0027 is\ngiven.  \u0027task_scs(tsk)\u0027 is the starting address of the task\u0027s shadow call\nstack, and \u0027__scs_magic(task_scs(tsk))\u0027 is the end address of the task\u0027s\nshadow call stack.  Here should be \u0027__scs_magic(task_scs(tsk))\u0027.\n\nThe user-visible effect of this bug is that when CONFIG_DEBUG_STACK_USAGE\nis enabled, the shadow call stack usage checking function\n(scs_check_usage) would scan an incorrect memory range.  This could lead\n\n1. **Inaccurate stack usage reporting**: The function would calculate\n   wrong usage statistics for the shadow call stack, potentially showing\n   incorrect value in kmsg.\n\n2. **Potential kernel crash**: If the value of __scs_magic(tsk)is\n   greater than that of __scs_magic(task_scs(tsk)), the for loop may\n   access unmapped memory, potentially causing a kernel panic.  However,\n   this scenario is unlikely because task_struct is allocated via the slab\n   allocator (which typically returns lower addresses), while the shadow\n   call stack returned by task_scs(tsk) is allocated via vmalloc(which\n   typically returns higher addresses).\n\nHowever, since this is purely a debugging feature\n(CONFIG_DEBUG_STACK_USAGE), normal production systems should be not\nunaffected.  The bug only impacts developers and testers who are actively\ndebugging stack usage with this configuration enabled."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:54:47.227Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1727e8bd69103a68963a5613a0ddb6d8d37df5d3"
        },
        {
          "url": "https://git.kernel.org/stable/c/cfdf6250b63b953b1d8e60814c8ca96c6f9d1c8c"
        },
        {
          "url": "https://git.kernel.org/stable/c/57ba40b001be27786d0570dd292289df748b306b"
        },
        {
          "url": "https://git.kernel.org/stable/c/062774439d442882b44f5eab8c256ad3423ef284"
        },
        {
          "url": "https://git.kernel.org/stable/c/9ef28943471a16e4f9646bc3e8e2de148e7d8d7b"
        },
        {
          "url": "https://git.kernel.org/stable/c/a19fb3611e4c06624fc0f83ef19f4fb8d57d4751"
        },
        {
          "url": "https://git.kernel.org/stable/c/08bd4c46d5e63b78e77f2605283874bbe868ab19"
        }
      ],
      "title": "scs: fix a wrong parameter in __scs_magic",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-71102",
    "datePublished": "2026-01-14T15:05:52.389Z",
    "dateReserved": "2026-01-13T15:30:19.651Z",
    "dateUpdated": "2026-05-11T21:54:47.227Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-71102",
      "date": "2026-05-25",
      "epss": "0.00033",
      "percentile": "0.09818"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-71102\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-01-14T15:15:59.210\",\"lastModified\":\"2026-03-25T18:56:00.797\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nscs: fix a wrong parameter in __scs_magic\\n\\n__scs_magic() needs a \u0027void *\u0027 variable, but a \u0027struct task_struct *\u0027 is\\ngiven.  \u0027task_scs(tsk)\u0027 is the starting address of the task\u0027s shadow call\\nstack, and \u0027__scs_magic(task_scs(tsk))\u0027 is the end address of the task\u0027s\\nshadow call stack.  Here should be \u0027__scs_magic(task_scs(tsk))\u0027.\\n\\nThe user-visible effect of this bug is that when CONFIG_DEBUG_STACK_USAGE\\nis enabled, the shadow call stack usage checking function\\n(scs_check_usage) would scan an incorrect memory range.  This could lead\\n\\n1. **Inaccurate stack usage reporting**: The function would calculate\\n   wrong usage statistics for the shadow call stack, potentially showing\\n   incorrect value in kmsg.\\n\\n2. **Potential kernel crash**: If the value of __scs_magic(tsk)is\\n   greater than that of __scs_magic(task_scs(tsk)), the for loop may\\n   access unmapped memory, potentially causing a kernel panic.  However,\\n   this scenario is unlikely because task_struct is allocated via the slab\\n   allocator (which typically returns lower addresses), while the shadow\\n   call stack returned by task_scs(tsk) is allocated via vmalloc(which\\n   typically returns higher addresses).\\n\\nHowever, since this is purely a debugging feature\\n(CONFIG_DEBUG_STACK_USAGE), normal production systems should be not\\nunaffected.  The bug only impacts developers and testers who are actively\\ndebugging stack usage with this configuration enabled.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.8.1\",\"versionEndExcluding\":\"5.10.248\",\"matchCriteriaId\":\"F54AC764-1B64-490B-8453-1CB63C5FFCD1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.198\",\"matchCriteriaId\":\"82159CAA-B6BA-43C6-85D8-65BDBC175A7E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.160\",\"matchCriteriaId\":\"C10CC03E-16A9-428A-B449-40D3763E15F6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.120\",\"matchCriteriaId\":\"43C3A206-5EEE-417B-AA0F-EF8972E7A9F0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.64\",\"matchCriteriaId\":\"32BF4A52-377C-44ED-B5E6-7EA5D896E98B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.3\",\"matchCriteriaId\":\"2DC484D8-FB4F-4112-900F-AE333B6FE7A7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.8:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"0E2DC66F-4A95-475F-B8B6-191DEC1E7EF6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"17B67AA7-40D6-4AFA-8459-F200F3D7CFD1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"C47E4CC9-C826-4FA9-B014-7FE3D9B318B2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F71D92C0-C023-48BD-B3B6-70B638EEE298\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"13580667-0A98-40CC-B29F-D12790B91BDB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"CAD1FED7-CF48-47BF-AC7D-7B6FA3C065FC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"3EF854A1-ABB1-4E93-BE9A-44569EC76C0D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"F5DC0CA6-F0AF-4DDF-A882-3DADB9A886A7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc8:*:*:*:*:*:*\",\"matchCriteriaId\":\"EB5B7DFC-C36B-45D8-922C-877569FDDF43\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/062774439d442882b44f5eab8c256ad3423ef284\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/08bd4c46d5e63b78e77f2605283874bbe868ab19\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/1727e8bd69103a68963a5613a0ddb6d8d37df5d3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/57ba40b001be27786d0570dd292289df748b306b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9ef28943471a16e4f9646bc3e8e2de148e7d8d7b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a19fb3611e4c06624fc0f83ef19f4fb8d57d4751\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cfdf6250b63b953b1d8e60814c8ca96c6f9d1c8c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.