In the Linux kernel, the following vulnerability has been resolved: riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp Under… (CVE-2026-99018)

The vulnerability in the Linux kernel's RISC-V entry code under CONFIG_SHADOW_CALL_STACK involved an incorrect determination of whether a trap came from userspace. The kernel used a comparison of the trap-time tp register (user-writable) against the current tp to decide whether to reload the kernel shadow call stack pointer (gp). An attacker could set tp to the linear-map address of its own task_struct before trapping, causing the kernel to skip reloading gp and continue execution with a poisoned gp value controlled by userspace. This allowed an unprivileged kernel arbitrary-write and control-flow hijack primitive. The fix changes the decision to use the hardware sstatus.SPP bit, which is set by hardware on trap entry and cannot be forged from user mode, thus correctly gating the shadow call stack reload.

An unprivileged user could exploit this vulnerability to perform arbitrary writes in kernel memory and hijack kernel control flow, potentially leading to privilege escalation or kernel compromise. The vulnerability arises from improper validation of the trap origin, allowing manipulation of the shadow call stack pointer.

A fix is available that changes the trap origin check to rely on the hardware sstatus.SPP bit instead of the user-writable tp register. Users should apply the official Linux kernel patch that addresses this issue. No alternative mitigations are indicated.