All vulnerabilities
CVE-2026-98951

Linux: riscv: ptrace: Zero-initialize regset buffers before copyin

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in89fc70d73f4ac8781f9e15edd1dbc6b6088453b3Also 59052a88ba5fe4a7bb34b3a0a42aa5d453d3bb97, 6.6CVE List
Published23 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

  • 89fc70d73f4ac8781f9e15edd1dbc6b6088453b3LinuxCVE List
  • 59052a88ba5fe4a7bb34b3a0a42aa5d453d3bb97LinuxCVE List
  • 6.6LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

riscv: ptrace: Zero-initialize regset buffers before copyin

user_regset_copyin() only copies count bytes, so a PTRACE_SETREGSET request with a short iov_len leaves the rest of the stack buffer uninitialized. In riscv_vr_set() that garbage is validated and copied into the target's vstate, and in riscv_cfi_set() it can be stored as the target's shadow stack pointer. Zero both buffers, as the get path already does.

Text from CVE List

Affected versions 8

  • Linuxaffected: 9300f00439743c4a34d735e1a27118eb68a1504e before 89fc70d73f4ac8781f9e15edd1dbc6b6088453b3CVE List
  • Linuxaffected: 9300f00439743c4a34d735e1a27118eb68a1504e before 59052a88ba5fe4a7bb34b3a0a42aa5d453d3bb97CVE List
  • Linuxaffected: f2a9cd050901c4734bc175294c3bd6a40a1a9e99CVE List
  • Linuxaffected: 6.5.3 before 6.6CVE List
  • Linuxaffected: 6.6CVE List
  • Linuxunaffected: all versions before 6.6CVE List
  • Linuxunaffected: 7.2.11 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 2