CVE-2026-98951riscv: ptrace: Zero-initialize regset buffers before copyin
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: riscv: ptrace: Zero-initialize regset buffers before copyin user_regset_copyin() only copies `count` bytes, so a PTRACE_SETREGSET request with a short iov_len leaves the rest of the stack buffer uninitialized. In riscv_vr_set() that garbage is validated and copied into the target's vstate, and in riscv_cfi_set() it can be stored as the target's shadow stack pointer. Zero both buffers, as the get path already does.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 23, 2026
- First seen by InfoSec Signals
- Oct 23, 2026
Affected products
Linux Linux linux:linux (from the name) | 9300f00439743c4a34d735e1a27118eb68a1504e builds before 89fc70d73f4ac8781f9e15edd1dbc6b6088453b3; from 9300f00439743c4a34d735e1a27118eb68a1504e before 59052a88ba5fe4a7bb34b3a0a42aa5d453d3bb97; f2a9cd050901c4734bc175294c3bd6a40a1a9e99; from 6.5.3 before 6.6 | CNA record |
References
- https://git.kernel.org/stable/c/89fc70d73f4ac8781f9e15edd1dbc6b6088453b3
- https://git.kernel.org/stable/c/59052a88ba5fe4a7bb34b3a0a42aa5d453d3bb97
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.