SECURITY ANNOUNCEMENT

CVE-2026-99018

23 October 2026

written by hardware on trap entry and cannot be forged from U-mode. Legitimate behaviour is unchanged: user entries (SPP=0) reload the task shadow call stack, nested kernel entries (SPP=1) skip it.

Introduced

6.7d1584d791a297aa8ed93503382a682a6ecfc4218

Fixed releases

6.12.1136639735367a7d491977e9e5e7afc50b489d81d83

6.18.577d1367a53137e379498eb8791295e58854378636

7.2.1137b4401ee6fa06046446d55e97e8d11784080843

7.34d0697f192975dab5985e921989be1d85cf580e9

View source announcement ↗