Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-98951

riscv: ptrace: Zero-initialize regset buffers before copyin

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: riscv: ptrace: Zero-initialize regset buffers before copyin user_regset_copyin() only copies `count` bytes, so a PTRACE_SETREGSET request with a short iov_len leaves the rest of the stack buffer uninitialized. In riscv_vr_set() that garbage is validated and copied into the target's vstate, and in riscv_cfi_set() it can be stored as the target's shadow stack pointer. Zero both buffers, as the get path already does.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 9300f00439743c4a34d735e1a27118eb68a1504e to < 89fc70d73f4ac8781f9e15edd1dbc6b6088453b3affected
  • 9300f00439743c4a34d735e1a27118eb68a1504e to < 59052a88ba5fe4a7bb34b3a0a42aa5d453d3bb97affected
  • f2a9cd050901c4734bc175294c3bd6a40a1a9e99affected
  • 6.5.3 to < 6.6affected

Linux Linux

Default version status: affected

  • 6.6affected
  • 0 to < 6.6unaffected
  • 7.2.11 to ≤ 7.2.*unaffected
  • 7.3 to ≤ *unaffected

References