Linux kernel x86/ftrace: dynamic trampoline mis-relocates per-cpu call-depth accounting, crashing the host

Impact

On retbleed-affected x86 hosts built with CONFIG_CALL_DEPTH_TRACKING and booted with retbleed=stuff, the copied CALL_DEPTH_ACCOUNT instruction in a dynamic ftrace trampoline keeps the %rip-relative displacement from its original location, so the first call into a traced function writes to an arbitrary wrong kernel address and panics the box. Any operator who attaches a kprobe or an eBPF/ftrace-based tracer - which is routine on GPU nodes running continuous profilers, node exporters and GPU telemetry agents - takes down the whole host and every tenant job on it. A GPU node that panics mid-training loses the checkpoint window for every rank on it, and a mis-relocated write into kernel memory is not confined to a crash in principle. The fix applies text_poke_apply_relocation() to both CALL_DEPTH_ACCOUNT slots in ftrace_caller and ftrace_regs_caller.

Who can reach it

Local, and in practice requires the privilege to register a kprobe or dynamic ftrace probe (root or CAP_SYS_ADMIN/CAP_BPF with access to /sys/kernel/tracing). Not reachable from an unprivileged tenant pod without tracing capabilities, and only on retbleed=stuff kernels - note the NVD vector is scored AV:N, which overstates the real reach.

What to do

Take the stable kernel fix (several branches patched; see the git.kernel.org commits in the references) and reboot each affected node - this is a built-in code path, not a module, so there is no hot-patch. As an interim mitigation on nodes that cannot be rebooted yet, boot without retbleed=stuff or avoid attaching kprobes/dynamic ftrace probes, which removes the trigger. Drain and reboot per node; no fixed release number is named in the record beyond the commits themselves.

References

Related entries

• Linux SLUB: krealloc __GFP_ZERO guarantee broken when red zoning is enabled without user trackingCVE-2026-64368 · Linux kernel SLUB allocator (init-on-alloc zeroing under SLAB_RED_ZONE)High
• Linux SUNRPC: unchecked percpu_counter_init leaves nfsd running on NULL per-cpu statsCVE-2026-89547 · Linux kernel SUNRPC (__svc_create per-pool percpu_counter init)High
• Linux NFSD: filecache shutdown race leaks nfsd_file objects and their stateCVE-2026-89667 · Linux kernel NFSD filecache (shrinker/GC/fsnotify vs per-net shutdown)High
• Linux kernel nfsd: use-after-free on the per-net file cache disposal queue during namespace teardownCVE-2026-89682 · Linux kernel nfsd (file cache delayed disposal, nfsd_fcache_disposal)High
• Linux kernel qla2xxx: use-after-free when a late response interrupt reaches an already-freed request queueCVE-2026-89848 · Linux kernel qla2xxx (qpair teardown, response IRQ vs request queue free)High
• Linux kernel qla2xxx: virtual port used after vport_slock is dropped, allowing a use-after-freeCVE-2026-89861 · Linux kernel qla2xxx (qla24xx_report_id_acquisition vport reference)High