Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2026-64082

riscv: Fix register corruption from uninitialized cregs on error

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: riscv: Fix register corruption from uninitialized cregs on error compat_riscv_gpr_set() calls cregs_to_regs() unconditionally, even when user_regset_copyin() fails. Since cregs is an uninitialized stack variable, a copyin failure causes uninitialized stack data to be written into the target task's pt_regs, corrupting its register state and potentially leaking kernel stack contents. compat_restore_sigcontext() has the same issue: it calls cregs_to_regs() even when __copy_from_user() fails, leading to the same corruption of the signal-returning task's register state on error. Only call cregs_to_regs() when the user copy succeeds.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 7383ee05314be58f8f9f018ee0ac53bef3808aea to < f2d88b0d7aebfa4643fc58bbae57210c6daff9c6affected
  • 7383ee05314be58f8f9f018ee0ac53bef3808aea to < 66dedb6028c3df6c6a3372dd935b823917e150d5affected
  • 7383ee05314be58f8f9f018ee0ac53bef3808aea to < 2a7d1daf2674fe7d5b1cc99a4e3b5f0f72d5958faffected
  • 7383ee05314be58f8f9f018ee0ac53bef3808aea to < 0599aa23734c48de9bce36d043a9ec90c23945a1affected
  • 7383ee05314be58f8f9f018ee0ac53bef3808aea to < 9e020156833f1ad0d425a1e3d85b65639f1c1c50affected
  • 7383ee05314be58f8f9f018ee0ac53bef3808aea to < 6ebcbb53fc9bc30843054ed99fd60b8e542628f4affected

Linux Linux

Default version status: affected

  • 5.19affected
  • 0 to < 5.19unaffected
  • 6.1.187 to ≤ 6.1.*unaffected
  • 6.6.156 to ≤ 6.6.*unaffected
  • 6.12.108 to ≤ 6.12.*unaffected
  • 6.18.49 to ≤ 6.18.*unaffected
  • 7.0.11 to ≤ 7.0.*unaffected
  • 7.1 to ≤ *unaffected

References