All vulnerabilities
CVE-2026-93266

Linux: arm64: RSI: fix field-spanning write warning in attestation token init

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.18%Chance of exploitation activity in the next 30 days, higher than 7% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in221049874b6a78c7d87bc826581b0695cd338e2bFixed versionCVE List
Published24 Sep 2026Updated 19 Oct 2026CVE List

What fixes it

  • 221049874b6a78c7d87bc826581b0695cd338e2bLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

arm64: RSI: fix field-spanning write warning in attestation token init

The challenge is passed in registers a1 through a8. However, copying to &regs.a1 makes FORTIFY treat the destination as the single a1 field, resulting in a field-spanning write warning. [1]

Overlay the SMCCC register structure with an RSI-specific argument layout and copy the challenge into an explicit 64-byte array. This keeps the existing a1-a8 argument encoding while giving the copy a correctly sized destination object.

[1] memcpy: detected field-spanning write (size 64) of single field "&regs.a1" at ./arch/arm64/include/asm/rsi_cmds.h:119 (size 8) WARNING: ./arch/arm64/include/asm/rsi_cmds.h:119 at rsi_attestation_token_init+0xdc/0xf8 [arm_cca_guest], CPU#0: cat/3314

Text from CVE List

Affected versions 8

  • Linuxaffected: b880a80011f56880f32bde47fc6af313359f926b before e505092cb200d430d5b8d8d3e926d45f29474ba3CVE List
  • Linuxaffected: b880a80011f56880f32bde47fc6af313359f926b before d29a8ee271da17b5e32d7a76a9c78d43f66447caCVE List
  • Linuxaffected: b880a80011f56880f32bde47fc6af313359f926b before 221049874b6a78c7d87bc826581b0695cd338e2bCVE List
  • Linuxaffected: 6.13CVE List
  • Linuxunaffected: all versions before 6.13CVE List
  • Linuxunaffected: 6.18.52 through 6.18.*CVE List
  • Linuxunaffected: 7.2.6 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 3