Riskcovery

CVE-2026-98951

riscv: ptrace: Zero-initialize regset buffers before copyin

State
Published
Severity
Not scored
Published
Oct 23, 2026
Updated
Oct 23, 2026
Reserved
Sep 25, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

riscv: ptrace: Zero-initialize regset buffers before copyin

user_regset_copyin() only copies `count` bytes, so a PTRACE_SETREGSET request with a short iov_len leaves the rest of the stack buffer uninitialized. In riscv_vr_set() that garbage is validated and copied into the target's vstate, and in riscv_cfi_set() it can be stored as the target's shadow stack pointer. Zero both buffers, as the get path already does.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 9300f00439743c4a34d735e1a27118eb68a1504e to before 89fc70d73f4ac8781f9e15edd1dbc6b6088453b3Affected
  • 9300f00439743c4a34d735e1a27118eb68a1504e to before 59052a88ba5fe4a7bb34b3a0a42aa5d453d3bb97Affected
  • f2a9cd050901c4734bc175294c3bd6a40a1a9e99Affected
  • 6.5.3 to before 6.6Affected
LinuxLinux
  • 6.6Affected
  • before 6.6Not affected
  • 7.2.11 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.