ghsa-65c4-f76q-3c6g
Vulnerability from github
In the Linux kernel, the following vulnerability has been resolved:
riscv: ftrace: Fixup panic by disabling preemption
In RISCV, we must use an AUIPC + JALR pair to encode an immediate, forming a jump that jumps to an address over 4K. This may cause errors if we want to enable kernel preemption and remove dependency from patching code with stop_machine(). For example, if a task was switched out on auipc. And, if we changed the ftrace function before it was switched back, then it would jump to an address that has updated 11:0 bits mixing with previous XLEN:12 part.
p: patched area performed by dynamic ftrace ftrace_prologue: p| REG_S ra, -SZREG(sp) p| auipc ra, 0x? ------------> preempted ... change ftrace function ... p| jalr -?(ra) <------------- switched back p| REG_L ra, -SZREG(sp) func: xxx ret
{
"affected": [],
"aliases": [
"CVE-2023-53694"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-22T14:15:43Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: ftrace: Fixup panic by disabling preemption\n\nIn RISCV, we must use an AUIPC + JALR pair to encode an immediate,\nforming a jump that jumps to an address over 4K. This may cause errors\nif we want to enable kernel preemption and remove dependency from\npatching code with stop_machine(). For example, if a task was switched\nout on auipc. And, if we changed the ftrace function before it was\nswitched back, then it would jump to an address that has updated 11:0\nbits mixing with previous XLEN:12 part.\n\np: patched area performed by dynamic ftrace\nftrace_prologue:\np| REG_S ra, -SZREG(sp)\np| auipc ra, 0x? ------------\u003e preempted\n\t\t\t\t\t...\n\t\t\t\tchange ftrace function\n\t\t\t\t\t...\np| jalr -?(ra) \u003c------------- switched back\np| REG_L ra, -SZREG(sp)\nfunc:\n\txxx\n\tret",
"id": "GHSA-65c4-f76q-3c6g",
"modified": "2025-10-22T15:31:10Z",
"published": "2025-10-22T15:31:10Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-53694"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/20a7510e781084364691b4962de31de758194cc9"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/84cfcf240f4a577733b1d98fcd2611a611612b03"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/8547649981e6631328cd64f583667501ae385531"
}
],
"schema_version": "1.4.0",
"severity": []
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.