CVE-2025-40358

What it actually does

KASAN incorrectly reports out-of-bounds access during stack unwinding for non-current tasks on RISC-V because shadow memory checks are performed on stacks belonging to other tasks.

Why it matters to the business

False-positive KASAN reports can mask real memory safety issues during kernel debugging and tracing, increasing risk of undetected corruption in RISC-V systems and complicating forensic analysis.

How an attack unfolds

No attacker-controlled exploitation path exists; the issue manifests only when the kernel unwinds a non-current task's stack while KASAN is active, triggering a spurious report identical to the previously fixed x86 case.

How to fix it

Apply commit f34ba22989da61186f30a40b6a82e0b3337b96fc or later; rebuild and deploy the fixed kernel image to all RISC-V systems. No workaround exists.

How to confirm the fix worked

Confirm presence of the commit in the running kernel source tree and verify that KASAN no longer reports out-of-bounds during cross-task unwinding tests.

Typical attack path

1. Trigger stack trace collection for a non-current task
2. KASAN performs invalid shadow checks on foreign stack memory
3. False BUG report is emitted in walk_stackframe

How to detect it

Review kernel logs for repeated KASAN out-of-bounds reports originating from walk_stackframe when tracing non-current tasks; no post-exploitation artifacts exist because the flaw is not exploitable.

What your security team should do

• Prioritize kernel update on all RISC-V production and development hosts within the next maintenance window
• Re-run KASAN-enabled stress and tracing workloads after patching to confirm absence of false reports
• Update kernel build pipelines to include the fix before next image release