{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2025-71102",
  "modified": "2026-10-07T17:22:01Z",
  "upstream": [
    "CVE-2025-71102"
  ],
  "published": "2026-01-14T15:06:27Z",
  "summary": "scs: fix a wrong parameter in __scs_magic",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nscs: fix a wrong parameter in __scs_magic\n\n__scs_magic() needs a 'void *' variable, but a 'struct task_struct *' is\ngiven.  'task_scs(tsk)' is the starting address of the task's shadow call\nstack, and '__scs_magic(task_scs(tsk))' is the end address of the task's\nshadow call stack.  Here should be '__scs_magic(task_scs(tsk))'.\n\nThe user-visible effect of this bug is that when CONFIG_DEBUG_STACK_USAGE\nis enabled, the shadow call stack usage checking function\n(scs_check_usage) would scan an incorrect memory range.  This could lead\n\n1. **Inaccurate stack usage reporting**: The function would calculate\n   wrong usage statistics for the shadow call stack, potentially showing\n   incorrect value in kmsg.\n\n2. **Potential kernel crash**: If the value of __scs_magic(tsk)is\n   greater than that of __scs_magic(task_scs(tsk)), the for loop may\n   access unmapped memory, potentially causing a kernel panic.  However,\n   this scenario is unlikely because task_struct is allocated via the slab\n   allocator (which typically returns lower addresses), while the shadow\n   call stack returned by task_scs(tsk) is allocated via vmalloc(which\n   typically returns higher addresses).\n\nHowever, since this is purely a debugging feature\n(CONFIG_DEBUG_STACK_USAGE), normal production systems should be not\nunaffected.  The bug only impacts developers and testers who are actively\ndebugging stack usage with this configuration enabled.",
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.160",
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71102"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/1727e8bd69103a68963a5613a0ddb6d8d37df5d3"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/cfdf6250b63b953b1d8e60814c8ca96c6f9d1c8c"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/57ba40b001be27786d0570dd292289df748b306b"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/062774439d442882b44f5eab8c256ad3423ef284"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/9ef28943471a16e4f9646bc3e8e2de148e7d8d7b"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/a19fb3611e4c06624fc0f83ef19f4fb8d57d4751"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/08bd4c46d5e63b78e77f2605283874bbe868ab19"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-05-12T04:54:46Z"
  }
}