CVE-2025-40358

Vulnerability

In the Linux kernel, when unwinding the stack of a task other than the current one on RISC-V, KASAN (Kernel Address Sanitizer) incorrectly reports a "BUG: KASAN: out-of-bounds in walk_stackframe+0x41c/0x460". This is a false positive caused by KASAN checking memory accesses that are actually valid for non-current tasks. The same issue was previously resolved on x86 by commit 84936118bdf3 ("x86/unwind: Disable KASAN checks for non-current tasks").

Exploitation

This vulnerability is triggered during stack unwinding operations for tasks that are not currently running. An attacker would need to be able to trigger such an unwinding, which typically requires local access or the ability to influence kernel stack tracing. No special privileges are required beyond those needed to initiate stack unwinding for another task.

Impact

The impact is a kernel panic or system crash due to the KASAN false positive, leading to a denial of service. The out-of-bounds report is spurious and does not represent an actual memory safety violation, but it can disrupt system operation.

Mitigation

The fix disables KASAN checks for non-current tasks during stack unwinding on RISC-V, mirroring the x86 solution applied to x86. The patch has been applied to the Linux kernel stable tree [1][2]. Users should update to a kernel version containing this fix.