CVE-2026-64082

riscv: Fix register corruption from uninitialized cregs on error

State: Published
Severity: 7.8 High
Published: Jul 19, 2026
Updated: Sep 2, 2026
Reserved: Jul 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

riscv: Fix register corruption from uninitialized cregs on error

compat_riscv_gpr_set() calls cregs_to_regs() unconditionally, even when user_regset_copyin() fails. Since cregs is an uninitialized stack variable, a copyin failure causes uninitialized stack data to be written into the target task's pt_regs, corrupting its register state and potentially leaking kernel stack contents.

compat_restore_sigcontext() has the same issue: it calls cregs_to_regs() even when __copy_from_user() fails, leading to the same corruption of the signal-returning task's register state on error.

Only call cregs_to_regs() when the user copy succeeds.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	7383ee05314be58f8f9f018ee0ac53bef3808aea to before f2d88b0d7aebfa4643fc58bbae57210c6daff9c6Affected 7383ee05314be58f8f9f018ee0ac53bef3808aea to before 66dedb6028c3df6c6a3372dd935b823917e150d5Affected 7383ee05314be58f8f9f018ee0ac53bef3808aea to before 2a7d1daf2674fe7d5b1cc99a4e3b5f0f72d5958fAffected 7383ee05314be58f8f9f018ee0ac53bef3808aea to before 0599aa23734c48de9bce36d043a9ec90c23945a1Affected 7383ee05314be58f8f9f018ee0ac53bef3808aea to before 9e020156833f1ad0d425a1e3d85b65639f1c1c50Affected 7383ee05314be58f8f9f018ee0ac53bef3808aea to before 6ebcbb53fc9bc30843054ed99fd60b8e542628f4Affected
LinuxLinux	5.19Affected before 5.19Not affected 6.1.187 through 6.1.Not affected 6.6.156 through 6.6.Not affected 6.12.108 through 6.12.Not affected 6.18.49 through 6.18.Not affected 7.0.11 through 7.0.*Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

7383ee05314be58f8f9f018ee0ac53bef3808aea to before f2d88b0d7aebfa4643fc58bbae57210c6daff9c6Affected
7383ee05314be58f8f9f018ee0ac53bef3808aea to before 66dedb6028c3df6c6a3372dd935b823917e150d5Affected
7383ee05314be58f8f9f018ee0ac53bef3808aea to before 2a7d1daf2674fe7d5b1cc99a4e3b5f0f72d5958fAffected
7383ee05314be58f8f9f018ee0ac53bef3808aea to before 0599aa23734c48de9bce36d043a9ec90c23945a1Affected
7383ee05314be58f8f9f018ee0ac53bef3808aea to before 9e020156833f1ad0d425a1e3d85b65639f1c1c50Affected
7383ee05314be58f8f9f018ee0ac53bef3808aea to before 6ebcbb53fc9bc30843054ed99fd60b8e542628f4Affected

LinuxLinux

5.19Affected
before 5.19Not affected
6.1.187 through 6.1.*Not affected
6.6.156 through 6.6.*Not affected
6.12.108 through 6.12.*Not affected
6.18.49 through 6.18.*Not affected
7.0.11 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.