CVE-2026-99018
Description
A flaw was found in the Linux kernel's RISC-V architecture support. When Shadow Call Stack (SCS), a security feature designed to protect function return addresses, is enabled, the kernel incorrectly validates whether an exception originated from userspace using a user-modifiable register. An unprivileged local attacker can exploit this flaw by manipulating the register before triggering an exception, tricking the kernel into skipping the reload of the protected stack pointer. This issue allows the attacker to corrupt memory and hijack kernel control flow, leading to arbitrary code execution and privilege escalation.
Statement
This flaw is rated as Important because a local unprivileged user can compromise kernel control-flow integrity to obtain elevated privileges instead of causing a standard system crash. Exploitation is strictly confined to RISC-V platforms built with Shadow Call Stack functionality enabled. Supported enterprise environments running on non-RISC-V architectures do not execute this architecture-specific exception code and are unaffected.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.8 | N/A | 7.8 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
