CVE-2024-35871riscv: process: Fix kernel gp leakage

Description

In the Linux kernel, the following vulnerability has been resolved: riscv: process: Fix kernel gp leakage childregs represents the registers which are active for the new thread in user context. For a kernel thread, childregs->gp is never used since the kernel gp is not touched by switch_to. For a user mode helper, the gp value can be observed in user space after execve or possibly by other means. [From the email thread] The /* Kernel thread */ comment is somewhat inaccurate in that it is also used for user_mode_helper threads, which exec a user process, e.g. /sbin/init or when /proc/sys/kernel/core_pattern is a pipe. Such threads do not have PF_KTHREAD set and are valid targets for ptrace etc. even before they exec. childregs is the *user* context during syscall execution and it is observable from userspace in at least five ways: 1. kernel_execve does not currently clear integer registers, so the starting register state for PID 1 and other user processes started by the kernel has sp = user stack, gp = kernel __global_pointer$, all other integer registers zeroed by the memset in the patch comment. This is a bug in its own right, but I'm unwilling to bet that it is the only way to exploit the issue addressed by this patch. 2. ptrace(PTRACE_GETREGSET): you can PTRACE_ATTACH to a user_mode_helper thread before it execs, but ptrace requires SIGSTOP to be delivered which can only happen at user/kernel boundaries. 3. /proc/*/task/*/syscall: this is perfectly happy to read pt_regs for user_mode_helpers before the exec completes, but gp is not one of the registers it returns. 4. PERF_SAMPLE_REGS_USER: LOCKDOWN_PERF normally prevents access to kernel addresses via PERF_SAMPLE_REGS_INTR, but due to this bug kernel addresses are also exposed via PERF_SAMPLE_REGS_USER which is permitted under LOCKDOWN_PERF. I have not attempted to write exploit code. 5. Much of the tracing infrastructure allows access to user registers. I have not attempted to determine which forms of tracing allow access to user registers without already allowing access to kernel registers.

Timeline

Scores

EPSS (exploitation in 30 days)

0.27% · top 81% of all CVEs (13 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.1.

Affected products

• Linux · Linux

  • affected 7db91e57a0acde126a162ababfb1e0ab190130cb – < 9abc3e6f1116adb7a2d4fbb8ce20c37916976bf5
  • affected 7db91e57a0acde126a162ababfb1e0ab190130cb – < dff6072124f6df77bfd36951fbd88565746980ef
  • affected 7db91e57a0acde126a162ababfb1e0ab190130cb – < f6583444d7e78dae750798552b65a2519ff3ca84
  • affected 7db91e57a0acde126a162ababfb1e0ab190130cb – < 00effef72c98294edb1efa87ffa0f6cfb61b36a4
  • affected 7db91e57a0acde126a162ababfb1e0ab190130cb – < d8dcba0691b8e42bddb61aab201e4d918a08e5d9
  • affected 7db91e57a0acde126a162ababfb1e0ab190130cb – < d14fa1fcf69db9d070e75f1c4425211fa619dfc8

• Linux · Linux

  • affected 4.15
  • unaffected < 4.15
  • unaffected 5.10.216 – ≤ 5.10.*
  • unaffected 5.15.154 – ≤ 5.15.*
  • unaffected 6.1.85 – ≤ 6.1.*
  • unaffected 6.6.26 – ≤ 6.6.*
  • unaffected 6.8.5 – ≤ 6.8.*
  • unaffected 6.9 – ≤ *

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• EUVD EUVD-2024-35589 (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2024-35871](https://cveledger.app/badge/CVE-2024-35871.svg)](https://cveledger.app/cve/CVE-2024-35871)

Record last updated 11 May 2026, 20:12 UTC.