Medium 5.5Published Jan 14, 2026

CVE-2025-71102scs: fix a wrong parameter in __scs_magic

Updated under an hour ago (Oct 26, 2026, 6:40 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: scs: fix a wrong parameter in __scs_magic __scs_magic() needs a 'void *' variable, but a 'struct task_struct *' is given. 'task_scs(tsk)' is the starting address of the task's shadow call stack, and '__scs_magic(task_scs(tsk))' is the end address of the task's shadow call stack. Here should be '__scs_magic(task_scs(tsk))'. The user-visible effect of this bug is that when CONFIG_DEBUG_STACK_USAGE is enabled, the shadow call stack usage checking function (scs_check_usage) would scan an incorrect memory range. This could lead 1. **Inaccurate stack usage reporting**: The function would calculate wrong usage statistics for the shadow call stack, potentially showing incorrect value in kmsg. 2. **Potential kernel crash**: If the value of __scs_magic(tsk)is greater than that of __scs_magic(task_scs(tsk)), the for loop may access unmapped memory, potentially causing a kernel panic. However, this scenario is unlikely because task_struct is allocated via the slab allocator (which typically returns lower addresses), while the shadow call stack returned by task_scs(tsk) is allocated via vmalloc(which typically returns higher addresses). However, since this is purely a debugging feature (CONFIG_DEBUG_STACK_USAGE), normal production systems should be not unaffected. The bug only impacts developers and testers who are actively debugging stack usage with this configuration enabled.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: May 11, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 5bbaf9d1fcb9be696ee9a61636ab6803556c70f2 before 1727e8bd69103a68963a5613a0ddb6d8d37df5d3; from 5bbaf9d1fcb9be696ee9a61636ab6803556c70f2 before cfdf6250b63b953b1d8e60814c8ca96c6f9d1c8c; from 5bbaf9d1fcb9be696ee9a61636ab6803556c70f2 before 57ba40b001be27786d0570dd292289df748b306b; from 5bbaf9d1fcb9be696ee9a61636ab6803556c70f2 before 062774439d442882b44f5eab8c256ad3423ef284; from 5bbaf9d1fcb9be696ee9a61636ab6803556c70f2 before 9ef28943471a16e4f9646bc3e8e2de148e7d8d7b; from 5bbaf9d1fcb9be696ee9a61636ab6803556c70f2 before a19fb3611e4c06624fc0f83ef19f4fb8d57d4751; from 5bbaf9d1fcb9be696ee9a61636ab6803556c70f2 before 08bd4c46d5e63b78e77f2605283874bbe868ab19	CNA record
linux linux_kernel linux:linux_kernel	from 5.8.1 before 5.10.248; from 5.11 before 5.15.198; from 5.16 before 6.1.160; from 6.2 before 6.6.120; from 6.7 before 6.12.64; from 6.13 before 6.18.3; 5.8; 6.19; and 7 more ranges	NVD

References

References

https://git.kernel.org/stable/c/1727e8bd69103a68963a5613a0ddb6d8d37df5d3	patch
https://git.kernel.org/stable/c/cfdf6250b63b953b1d8e60814c8ca96c6f9d1c8c	patch
https://git.kernel.org/stable/c/57ba40b001be27786d0570dd292289df748b306b	patch
https://git.kernel.org/stable/c/062774439d442882b44f5eab8c256ad3423ef284	patch
https://git.kernel.org/stable/c/9ef28943471a16e4f9646bc3e8e2de148e7d8d7b	patch
https://git.kernel.org/stable/c/a19fb3611e4c06624fc0f83ef19f4fb8d57d4751	patch
https://git.kernel.org/stable/c/08bd4c46d5e63b78e77f2605283874bbe868ab19	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.