CVE-2026-64235

Name of the Vulnerable Software and Affected Versions Linux kernel version 7.0.10

Description An issue exists in the x86 ftrace implementation where registering a dynamic ftrace trampoline on retbleed-affected platforms (such as Skylake) with CONFIG CALL DEPTH TRACKING enabled and retbleed=stuff configured can lead to a kernel panic. The problem occurs because the call depth accounting uses %rip-relative addressing for the x86 call depth variable. Since the exact memory location of the trampoline varies, the displacement is not correctly adjusted at runtime, resulting in a page fault when the traced function is first called.

Recommendations Update Linux kernel version 7.0.10 to a version where the %rip-relative displacement of the CALL DEPTH ACCOUNT instruction is corrected via text poke apply relocation().