CVE-2026-99018

The Linux kernel is vulnerable to an unprivileged kernel arbitrary-write and control-flow-hijack primitive when CONFIG_SHADOW_CALL_STACK is enabled on riscv architecture. The root cause lies in handle_exception(), which incorrectly uses the user-writable tp register to determine if a trap origina...